Why indicators of attack matter
Indicators of attack (IOAs) help security teams spot suspicious behavior while an attack is still developing. Instead of waiting for clear evidence that a system has already been compromised, IOAs focus on what an attacker appears to be trying to do.
That makes them useful for security teams that need to move quickly from alert review to investigation. A single failed login might not mean much on its own. A pattern of failed logins, followed by a successful login from an unusual location and access to sensitive systems, can tell a much more useful story. IOAs can help teams:
- Recognize active attack behavior earlier, especially when an attacker uses legitimate tools or valid credentials
- Understand attacker intent, such as privilege escalation, lateral movement, or data access
- Connect related activity across systems, including endpoints, identities, networks, and cloud environments
- Improve threat hunting, by giving analysts behavior-based patterns to investigate
- Support faster triage, because analysts can focus on what the activity suggests, not just whether one alert fired.
How indicators of attack work
IOAs work by identifying patterns of behavior that are unusual, risky, or aligned with known attacker tactics, techniques, and procedures (TTPs). These patterns can come from many sources: endpoint activity, authentication logs, network traffic, cloud events, application behavior, or identity systems.
A useful IOA usually depends on context, like when an administrator opens a remote access tool during a planned maintenance window; this may be normal. A standard user account launching that same tool at 2 a.m., then attempting to access multiple servers – that deserves investigation.
A typical IOA workflow
Security teams usually move through a sequence like this:
- Activity occurs: A user, host, process, or service performs an action.
- Telemetry is collected: Security tools capture logs, events, commands, network connections, or identity activity.
- Suspicious behavior is detected: Analytics, detection rules, or behavioral models identify a risky pattern.
- Context is reviewed: Analysts compare the activity against normal behavior, business context, and known attack techniques.
- Response begins: The team investigates, contains, escalates, or tunes the detection based on what they find.
IOAs often map well to the MITRE ATT&CK framework because they describe behavior and technique, not only evidence. That helps analysts ask better questions: Is this account trying to escalate privileges? Is this host moving laterally? Is this process behaving like a known attacker technique?
Key types and examples of indicators of attack
Indicators of attack can appear across many parts of an environment. The most useful examples are often behavioral patterns that would be easy to miss if each event were reviewed in isolation.
Privilege escalation
Privilege escalation happens when an account or process attempts to gain a higher level of access. An IOA might be a standard user account suddenly attempting administrative actions, probing restricted directories, or changing permissions.
This does not always mean an attacker is present, as a misconfigured script or legitimate IT work could create similar activity. The value of the IOA is that it gives analysts a reason to investigate the behavior in context.
Lateral movement
Lateral movement occurs when an attacker tries to move from one system to another inside an environment. A possible IOA could be one workstation authenticating to several internal servers in a short period, especially if that workstation does not normally connect to those systems.
This kind of behavior matters because many attacks do not stop at the first compromised system. Attackers often look for broader access, sensitive data, or systems that help them maintain control.
Credential misuse
Credential misuse can show up as unusual login behavior, with examples like impossible travel patterns, repeated authentication failures followed by a successful login, logins from unfamiliar devices, or access attempts outside normal working hours.
These patterns are especially important because attackers often use valid credentials. When credentials are legitimate, detection depends less on blocking a known bad file and more on noticing behavior that does not fit the account.
Masquerading and living off the land
Attackers often try to blend in by using legitimate tools or renaming files and processes. A security team might investigate when a trusted utility runs from an unusual path, launches unexpected child processes, or appears with a suspicious name. These behaviors can be signs that an attacker is using normal administrative tools for unauthorized activity.
Data staging or exfiltration behavior
An IOA can also point to suspicious data activity, with examples like large data reads, unusual file compression, unexpected archive creation, or outbound transfers that do not match normal business patterns.
On their own, these events may not prove data theft. Together, they can suggest that an attacker is preparing data for exfiltration or attempting to move it out of the environment.
Indicators of attack vs. indicators of compromise
Indicators of attack and indicators of compromise (IOCs) are related, but they’re not the same thing. Security teams should use both.
Indicators of attack focus on behavior, helping teams identify what an attacker may be trying to do while the activity is unfolding. IOCs focus on evidence that a compromise may already have happened, such as a known malicious file hash, suspicious IP address, or malware signature.
Concept | What it focuses on | Timing | Example |
Indicator of attack | Behavior, intent, and active tactics | Before or during attack progression | A user account attempting unusual privilege escalation |
Indicator of compromise | Evidence or artifacts of compromise | Often after compromise | A known malicious file hash or command-and-control IP address |
How IOAs fit into security operations
IOAs are most useful when they support the everyday work of security operations. They can inform detection rules, threat hunting, alert triage, incident response (IR), and long-term detection improvement.
In a security operations center (SOC), IOAs help analysts move beyond isolated alerts. Instead of treating each event as separate, analysts can look for patterns that show intent. That makes IOAs useful for threat detection, especially when attackers use valid accounts or common tools.
On a threat hunt, a hunter might start with a question like, “Are any non-admin accounts attempting administrative actions across multiple hosts?” That question is based on behavior, not a known malicious file.
Where IOAs commonly appear
IOAs may surface in several security workflows:
- SIEM detections: Correlating logs and events across systems
- EDR or XDR alerts: Identifying suspicious endpoint behavior
- UEBA models: Finding abnormal user or entity behavior
- Threat hunting: Testing hypotheses about attacker activity
- Incident response: Prioritizing containment based on active behavior
User and entity behavior analytics (UEBA) can be especially relevant because many IOAs depend on understanding what is normal for a user, device, or service.
IOAs do not replace investigation, rather provide analysts with a stronger starting point. A good IOA points to behavior worth reviewing, then human judgment, business context, and supporting evidence determine what happens next.
Frequently asked questions
An indicator of attack is a behavioral sign that suggests an attack may be underway or about to occur. IOAs focus on activity patterns, attacker intent, and tactics rather than static evidence left behind after a compromise.
An example of an indicator of attack is a standard user account suddenly attempting administrative actions across several systems. Other examples include unusual lateral movement, suspicious use of legitimate tools, abnormal access times, or large data transfers outside normal patterns.
An IOA focuses on suspicious behavior that may show an attack in progress. An IOC focuses on evidence that a compromise may have already occurred, such as a malicious file hash, suspicious IP address, or malware signature.
Threat hunters use IOAs to form behavior-based hypotheses and search for signs of active or developing attacks. For example, they might hunt for unusual authentication patterns, privilege escalation attempts, or lateral movement across internal systems.