Short version: IOC basically are any piece of data that can be considered unsual on a system or network that could serve as a fingerprint of an attack or maybe an infection.
One of the ways malware writers establish persistence within an infected host is through registry changes.
malware.exe ALWAYS create a folder in
C:\Tmp\WindowsAdmin666, so, if you have that folder, this could mean that you're infected, this is an IOC (Suspicious Registry Or System File Changes).
As "Digital Guardian" says, Indicators of compromise (IOCs) are “pieces of forensic data, such as data found in system log entries or files, that identify potentially malicious activity on a system or network.”
Indicators of compromise aid information security and IT professionals in detecting data breaches, malware infections, or other threat activity. By monitoring for indicators of compromise, organizations can detect attacks and act quickly to prevent breaches from occurring or limit damages by stopping attacks in earlier stages.
Indicators of compromise act as breadcrumbs that lead infosec and IT pros to detect malicious activity early in the attack sequence. These unusual activities are the red flags that indicate a potential or in-progress attack that could lead to a data breach or systems compromise. But, IOCs are not always easy to detect; they can be as simple as metadata elements or incredibly complex malicious code and content samples. Analysts often identify various IOCs to look for correlation and piece them together to analyze a potential threat or incident.
Examples of IOC include unusual network traffic, unusual privileged user account activity, login anomalies, increases in database read volume, suspicious registry or system file changes, unusual DNS requests and Web traffic showing non-human behavior. These and other unusual activities allow security teams monitoring the systems and networks to spot malicious actors earlier in the intrusion detection process.
If theory was confusing, then a good example might help to understand IOC, this document is from SANS: Using IOC (Indicators of Compromise) in Malware
Hope this helps.