End of Life of an Indicator of Compromise (IOC)
Summary: Dragos analysts note that security teams routinely ask whether an IOC from a months-old report still warrants concern, and the answer is "it depends" - there is no fixed end of life for an indicator. The post covers hashes, IP addresses and domains, noting that flipping one bit of malware changes its hash, that IP addresses carry little cost for adversaries to move, and that public threat reporting or blocking IPs and domains can burn an IOC - as when STIBNITE moved infrastructure six times in a week in April 2021 only to return to known infrastructure.
Why it matters: Dragos recommends not expiring IOCs but leaning on threat behaviors, and warns that indicators used without aptitude become a direct path to alert fatigue for the SOC - with analysts commonly finding hits on endpoints for indicators the adversary last used over a year ago.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026