An Indicator of Compromise (IoC) is a piece of forensic data that suggests a system or network may have been breached. Common IoCs include malicious file hashes, command-and-control IP addresses, suspicious domain registrations, and known-bad URLs.
Infostealer intelligence introduces identity-based IoCs: specific credentials, session cookies, and infection timestamps tied to real machines. These identity IoCs are often more actionable than traditional network IoCs because they tell you exactly which user or device is exposed.