Intelligence
What is Indicator of attack?
Evidence of attacker behaviour in progress, such as a process dumping credentials, rather than a static artefact like a hash or IP.
An indicator of attack, or IOA, describes behaviour that shows an attack is happening, regardless of the specific files or addresses involved. Examples include an Office application launching a script interpreter, a process reading LSASS memory, or mass file renaming typical of encryption.
IOAs sit near the top of the Pyramid of Pain alongside TTPs. They catch new variants that indicators of compromise miss, at the cost of needing richer telemetry and more careful tuning.