Indicators of compromise definition and common questions
The basics of IOCs
What is the indicators of compromise definition in plain words?
An IOC is a piece of evidence that suggests a system may have been breached or infected: a file hash, an IP address, a domain name, a URL, a file name, a registry key or a scheduled task name. A match means investigate. It never confirms a breach on its own.
What are ransomware indicators of compromise?
They are the traces ransomware leaves on a system you own: ransom-note text files appearing in many folders, many files renamed with a new extension in a short time, and backups or shadow copies being deleted. Treat each as urgent, and follow your incident-response plan.
Where do IOCs come from?
Four common sources: advisories and incident reports, your own past incidents, threat-sharing formats such as STIX, and notes pasted into a text file. Dates matter. Prefer reliable IOC sources for threat hunting, and check each entry's date, because addresses and domains go stale fast.
How do IOCs differ from indicators of attack?
An IOC says an artifact was seen, such as a hash or a domain, while an indicator of attack describes behaviour, such as a program starting at an odd time. Hashes change with any rebuild. The Pyramid of Pain ranks indicators by how hard they are for an attacker to change.
Using GoChannel Desk
Is gocodesy.com the official GoChannel Desk website?
Yes, gocodesy.com is the official GoChannel Desk website. Download the original build from this site and compare its SHA-256 checksum with the published manifest before you run it. Skipping that step is a mistake. Questions go through the Send feedback button inside the app.
Are the results always right?
No. A search shows only what is in the logs and the list you give it, so you must read every match in context and every diff before accepting. Results can miss things. A clean search never proves a system is clean, and GoChannel Desk does not promise complete results.
Can I practise an investigation on my own logs?
Yes, on logs and files you own or are authorised to examine. Use copies only. You can replay a past incident or a lab PC's logs as a small real-world digital forensics case study, while the agent searches and writes notes and you draw the conclusions.
Does it replace a computer forensics professional?
No. A professional decides what a match means, preserves evidence and talks to your security team. GoChannel Desk only runs searches and drafts notes that a person then checks. It does not detect threats in real time and it is not a threat-intelligence feed.
Models, privacy and download
Which model should I connect?
Three options: a cloud AI provider through a standard API endpoint, a model running on your own PC, or the built-in model. Logs contain personal data such as IP addresses and usernames, so a local model keeps them on the machine, while a cloud model receives what the agent sends.
Does GoChannel Desk send my logs anywhere?
Yes, if you choose a cloud model: the log lines the agent puts in a prompt are sent to that endpoint. With a local model nothing leaves the machine. Chats, working folders and API keys stay on the PC, and secrets in tool output are redacted before they reach the model. There is no telemetry.
How do I download and verify GoChannel Desk?
Two steps. Download the setup program, about 34 MB, then run certutil -hashfile on it and compare the SHA-256 value with the published manifest. A portable single .exe of about 25 MB also exists. Windows SmartScreen may warn because the installer is not code-signed yet, so continue only after the values match.
