In more detail
Security teams share IOCs from known attacks so others can search their logs and files for matches: a malicious file's Hash, a command-and-control address, an odd registry key or an unusual outbound connection. Typical types are file hashes, IP addresses, domain names, URLs, registry keys, mutex names and email subjects. IOCs go stale as attackers change infrastructure, so behaviour-based detection complements them. Defang URLs when sharing them, with the URL Defanger, so nobody clicks one by accident.
Why it matters
IOCs turn one victim's discovery into protection for everyone: a hash or domain seen in one incident can be searched across thousands of machines in minutes. Their weakness is cheapness for the attacker. Recompiling a program changes its hash at no cost, whereas changing how an attack behaves is slow and expensive. An empty search result proves little, because the attacker may be using indicators you have never been given.
Example
A short IOC list from a made-up incident, in defanged form:
sha256 dedc2998a30e8541388da9849d4043177ec133bd3f454dd903a75edbcd6888db
ip 203.0.113.45
url hxxps://payload[.]example[.]net/update.exe
The hash is the SHA-256 of a file containing the text example payload (try it with the Hash Generator); the address is from a range reserved for documentation. To hunt, search logs for the address, for example grep -F 203.0.113.45 access.log, or look through the Log Forensics for connections to it. Remember to refang the values before using them in a search.