Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect this MD5 hash string? How would my firewalls and IDS going to check against this MD5 hash? I am a bit lost on the concept of indicators of compromise. thanks
This MD5 hash is just a cryptographic hash of a file, i.e. a unique identifier of the file's contents. You can compute a (more-or-less) unique MD5 hash of any file.
What does it have to do with security? You see, when you have a malicious file, you can compute its MD5 hash just like with any other file. Then, if you get this malicious file in your system and compute its hash, you will get exactly the same MD5 hash. What does this mean? It means that your security software can scan your entire file system, computing the MD5 hashes of every single potentially dangerous file and comparing them to the hash of the malicious file. If it finds a match, that means trouble!
In your example, there is a list of MD5 hashes of dangerous files. If the MD5 hash of any file on your computer matches one of these, you're probably screwed.
This is quite a basic malware-detection technique, and it is easily negated by encrypting malware. However, it was the best weapon in the arsenal of most of the earliest antiviruses.