Artifacts or evidence left behind by attackers (like malicious URLs, IP addresses, or file hashes) that reveal a security breach.