Indicators of Compromise (Telecom IoCs)

Indicators of Compromise are the observable artifacts, IP addresses, domain names, file hashes, signalling patterns, anomalous Global Titles or Diameter realms, that suggest a security incident has occurred. Telecom-specific IoCs include unusual MAP operations, GTP from unexpected peers, and fraud-pattern call detail records. IoCs feed SIEM detection rules and threat-intelligence sharing.

Categories: SignalingSecurity ControlsThreats and Attacks

Indicators of Compromise (Telecom IoCs) in context

Signaling protocols carry the control-plane messages that set up calls, register subscribers and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA as top-tier telecom risk.

Security controls span signaling firewalls (SS7/Diameter/GTP screening), transport encryption (IPsec, TLS, PRINS), identity and access on OSS/BSS, and monitoring at both packet and log level. Controls are audited against GSMA FS.11/FS.19/FS.20/FS.36.

To place Indicators of Compromise (Telecom IoCs) in the wider telecom-security picture, review Global Title Abuse, IPS, Anomaly Detection, Telecom SIEM, PCAP and ACL: each entry cross-references back to this page so you can walk the topic in either direction.

Related terms

Related topic hubs

  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • Diameter Security 4G/LTE Diameter threats across IPX/roaming and DEA defenses.
  • Diameter Attacks S6a IDR/PUR/CLR abuse, subscriber tracking, LTE signaling attacks.
  • SS7 Security SS7/MAP/CAP/SCCP attacks and defenses across 2G/3G interconnect.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.