How to Analyze Indicators of Compromise

What it is

A practical mapping from each IOC family to the tool that analyzes it, and how to iterate the result into the next indicator.

Why it matters

IOCs are only useful when matched to the right tool and when results are chained into a narrative. This turns a scattered set of indicators into a scoped investigation with a recommended next step.

How to analyze by family

• File hash → Hash Checker (guides:tool-hash-guide) — confirm known-good/malicious, then pivot to origin/parent.
• IP → IP Reputation + DNS (guides:tool-ip-guide) — reputation, ASN, passive-DNS links.
• Domain → DNS + URL reputation (guides:tool-dns-guide, guides:tool-url-guide).
• URL → URL Analyzer/Reputation (guides:tool-url-analyzer-guide), decode before judging.
• Email → Email Header analysis (guides:tool-email-header-guide), extract sender/links/attachment hashes to pivot.
• CVE → CVE Lookup (guides:tool-cve-guide) for severity/KEV/patch context.
• Cross-family: IOC Lookup (guides:tool-ioc-guide) searches the intelligence store for any record mentioning the indicator.

Detection / interpretation

Read each tool’s interpretation guide; never treat a single low-fidelity signal (shared IP) as definitive — combine families (see security:types-of-iocs).

Investigation

Follow the pivot chain: hash → host → C2 IP → other hosts → TTPs → linked campaign (see guides:intelligence-dashboard equivalent entries in guides:cyber-intelligence-workflow).