Evidence of compromise is any artefact that shows a system, account, or network may have been breached or abused. It can include malicious files, unusual logins, altered configurations, suspicious processes, or attacker-controlled network traffic, and it is used to confirm an incident and scope the response.
What Evidence of Compromise Means in Practice
Evidence of compromise is the set of artefacts that show a system, account, or network may have been breached or abused. The key idea is not certainty from a single clue, but enough corroborating signs to treat the event as a real incident and start scope determination.
Those artefacts can be direct, such as malicious binaries, suspicious processes, attacker-controlled network traffic, or altered configurations. They can also be indirect, such as unusual authentication activity, new persistence mechanisms, or unexpected changes in system state that fit a known compromise pattern.
Why These Artefacts Matter
Evidence of compromise matters because most incidents are confirmed by patterns, not by one perfect indicator. A single unusual login may be benign, but several aligned signs can establish that the environment has been abused and that the organisation should move from monitoring into response.
The practical value is speed and confidence: the sooner defenders recognise a credible compromise signal, the sooner they can contain the affected assets, preserve volatile evidence, and reduce the chance of attacker persistence or lateral movement.
Common Forms of Evidence
In real investigations, evidence usually appears across endpoint, identity, network, and configuration layers. Examples include unknown executables, scheduled tasks, service changes, new administrative access, signs of log tampering, or traffic patterns that suggest command-and-control activity.
Good evidence is also contextual. A malicious file on its own may not prove impact, but the same file combined with process injection, outbound beaconing, or recent privilege escalation is much stronger evidence that a compromise is active or recent.
How Analysts Use It to Confirm and Scope an Incident
Once evidence appears, analysts use it to answer two questions: did compromise occur, and how far did it spread? That means correlating artefacts across logs, EDR telemetry, cloud control planes, directories, and network records to reconstruct the attacker path and identify affected hosts, accounts, and sessions.
In that sense, evidence of compromise is both a detection concept and a response input. It helps determine whether an event is isolated, whether credentials or keys may be exposed, and whether the organisation must treat the environment as partially trusted until remediation is complete.
Risk and Threat Considerations
Evidence of compromise is dangerous because it often appears after an adversary has already gained a foothold. By the time defenders see malicious files, abnormal logins, or attacker-controlled traffic, the attacker may already have established persistence, stolen credentials, or moved laterally.
Failure mechanism: Defensive visibility is incomplete, so early abuse looks like ordinary activity until multiple artefacts line up. Attackers benefit from that delay by hiding in normal operations, blending into expected traffic, and using legitimate credentials or tools to reduce obvious alarms.
Impact: A missed or understated compromise can leave stolen access, altered configurations, or covert exfiltration in place long enough to expand the incident. That increases containment time, recovery cost, and the chance that trusted accounts, sessions, or secrets must be rotated after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Evidence of compromise depends on anomalous events and suspicious activity being monitored. |
| RS.AN-01 — Analysis | Confirming compromise requires analysing indicators and reconstructing what happened. | |
| Recommendation — Correlate anomalous events across endpoints, identities, and networks to confirm compromise evidence. Analyze observed artefacts to determine compromise scope, root cause, and likely attacker activity. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Unusual logins and abuse of legitimate access are common compromise evidence patterns. |
| T1059 — Command and Scripting Interpreter | Suspicious processes often reflect attacker execution used to establish or maintain compromise. | |
| Recommendation — Hunt for valid-account abuse when login activity and downstream actions look inconsistent with normal use. Map suspicious process execution to attacker runtime activity and validate whether it belongs in the incident scope. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Logs are a primary source of evidence for confirming compromise and tracing attacker actions. |
| Recommendation — Preserve and review logs that can prove compromise, timeline, and affected assets. | ||
Practitioner Guidance
What to watch for: Treat evidence as a correlation exercise, not a single-signature judgement. Analysts should look for combinations that strengthen each other, such as a new login source paired with unusual process execution, or a configuration change paired with suspicious outbound connections.
Governance implication: Organisations should define who can declare evidence sufficient to open an incident, preserve artefacts, and trigger containment. Clear thresholds prevent both under-response, where compromise is missed, and over-response, where isolated anomalies are treated as incidents without support.
Practitioner takeaway: The best evidence is the artefact set that tells a consistent story across logs, endpoints, and identity records, because compromise is usually proven by convergence rather than by a single indicator.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org