Indicator of compromise
An artefact that suggests a compromise: a hash, a name, an address, an email. Useful. Not a strategy.
An indicator of compromise is something you can match: file hash, IP, domain, URL, certificate, mailbox. Feeds ship them. Blocklists consume them. They go stale. Operators rotate infrastructure faster than some lists update.
Use IOCs to pivot and to catch the lazy copy-paste. Do not build the whole SOC around yesterday's addresses. Pair with TTPs so you still see them when the domain changes.
See also: Tactics, techniques, and procedures, Threat intelligence, Passive DNS, MITRE ATT&CK.