> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Indicators of Compromise

> What an ICS/OT IoC means when the source is a honeypot sensor network.

An **Indicator of Compromise (IoC)** is an observable that suggests malicious or suspicious activity — typically IPs, domains, hashes, or URLs. In Reyhford’s domain, IoCs are usually **source IPs** (and related metadata) that probed or attacked ICS honeypots.

## IoCs in an OT context

Traditional IT IoCs often mean “this host was seen in malware C2.” ICS honeypot IoCs more often mean:

* Internet-wide industrial scanning
* Targeted reconnaissance against Modbus/S7/BACnet/IEC 104/EtherNet/IP/ATG
* Write or command attempts against emulated controllers

That is still actionable: blocklists, firewall rules, CERT advisories, and hunting queries for the same sources on your perimeter.

## What we attach to each IoC

Through enrichment, Reyhford indicators may include:

* Protocol / port context
* MITRE ATT\&CK for ICS technique tags
* Confidence score
* Sensor / region of observation
* Timestamps for first/last seen style analytics

## How to use them

| Role          | Use                                       |
| ------------- | ----------------------------------------- |
| SOC L2/L3     | Hunt + block; correlate with VPN/firewall |
| CISO          | Brief risk with protocol + region context |
| National CERT | Sector advisories; share via TAXII peers  |

See [STIX 2.1](/fundamentals/stix-21) and [Confidence scoring](/fundamentals/confidence-scoring).