What Are Indicators of Attack?

Indicators of attack are real-time signals or behavioral patterns that suggest a cyber attack is in progress. Security teams rely on them to identify malicious activities before attackers can cause serious damage.

Indicators of attack, also referred to as IoA, cover a broad range of suspicious activities, from unusual network traffic and unauthorized access attempts to abnormal process execution and data exfiltration patterns. 

These signals capture what an attacker is doing rather than what tools they are using. As such, they remain relevant even when attackers change their tools and methods.

Table of Contents

• Indicators of Attack vs. Indicators of Compromise (IoCs): Key Differences
• Types and Examples of Indicators of Attack 
• Why Are Indicators of Attack Important in Cybersecurity?
• Limitations of Indicators of Attack
• How to Hunt for Indicators of Attack
• Where to Find Indicators of Attack Data

Read More about Indicators of Attack

Here is a deeper look at what indicators of attack are, how they work, and why security teams need to understand them. But first, let’s see how it differs from indicators of compromise (IoCs).

Indicators of Attack vs. IoCs: Key Differences

Understanding the differences between indicators of attack and IoCs is important for building a complete security strategy. Here’s a quick look at how they differ. 

Timing is the biggest difference. IoAs are detected while an attack is in progress, whereas IoCs are backward-looking — they are discovered after a breach has already occurred. 

Their focus and goals are also different. IoAs focus on attacker behavior and intent, asking questions such as “What is this entity trying to do right now?” The goal is to stop an active attack. 

On the other hand, IoCs concentrate on investigating an attack that has already happened, looking at artifacts and evidence, and answering, “What proof do we have that a breach happened?” 

IoC data includes malicious IP addresses, file hashes, domain names, registry artifacts, and other evidence uncovered during post-incident forensic analysis. Since IoCs might overlap with legitimate activities in other environments, IoCs can produce more false positives. Meanwhile, IoAs can provide higher-fidelity detections because they focus on behavior, but they also require more sophisticated analysis and tuning.

With that said, it’s worth noting that the value of detecting both is complementary. The strongest security postures use IoAs, IoCs, and other threat data together.

Types and Examples of Indicators of Attack 

There are several categories of IoAs. Understanding each type helps security teams know where to look and what behavior to flag. 

Lateral Movement IoAs

These are activities that indicate an attacker is trying to reach other systems, users, or segments within the same network environment. Lateral movement is how a limited breach becomes a full network compromise, making it one of the most important categories to detect early.

Example: Unusual authentication attempts between internal systems, Remote Desktop Protocol (RDP) connections from unexpected sources, and new internal network shares being accessed for the first time are all common examples. 

Privilege Escalation IoAs

Attackers usually attempt to gain higher-tier system access so they can move from a limited foothold toward full control. Privilege escalation is a turning point in most attack chains. Catching it early can stop an attacker before they gain the access needed to cause serious damage.

Example: A regular user account suddenly attempts to modify system-level registry keys, install new services, or perform any admin-level actions. 

Network-Based IoAs

These indicators refer to suspicious activities detected at the network level, which is often the first place an attacker leaves traces when attempting to move data or communicate with external systems.

Example: An internal endpoint making repeated requests to an external server it has never communicated with before. Attackers may spoof or mask the source IP to make it look like a trusted address. Network monitoring tools need to trace these requests back to their actual origin to catch this kind of masking.

Unauthorized Data Movement IoAs

These indicators signal that threat actors are copying, transferring, or preparing to exfiltrate an organization’s data to destinations outside of normal business operations.

Example: A sudden spike in outbound traffic to an external server that internal systems have no prior relationship with. Security systems scan for unusual traffic spikes to external servers or traffic involving malicious IP addresses, and can also identify attempts to access data that should be off-limits. Even without a known malicious IP, the volume, timing, and destination of a transfer can be enough to flag it as suspicious.

Login-Related IoAs

These are abnormal authentication patterns that suggest stolen credentials, brute force attempts, or an attacker impersonating a legitimate user.

Login attempts from unfamiliar locations or devices during unusual times can indicate a compromised credential or brute force attack. These patterns are valuable because they can detect account takeovers before the attacker has a chance to do any real damage.

Example: A user who normally logs in from one geographic location but suddenly logs in from another part of the world.

Email-Related IoAs

These indicators of attack are tied to incoming email that suggests a phishing attempt or signals the early stages of a social engineering attack. A well-crafted phishing email can look nearly identical to a legitimate one, so detection tools should be trained to look for combinations of signals rather than just one red flag.

Example: Several employees across different departments receive an email from an unknown email address with embedded links to a suspicious website or unsolicited attachments. 

Execution-Related IoAs

These are suspicious or unauthorized processes being launched on a system by attackers when deploying malware or updating configuration settings. Catching these executions early matters because this is often the stage where malware gets installed, or ransomware gets triggered. Once execution happens, the window for prevention closes fast.

Example: A user account executes administrative commands that it has never run before. Another example is a PowerShell or cmd.exe spawning child processes, downloading files from the internet, or running from an unusual directory.

Why Are Indicators of Attack Important in Cybersecurity?

Security tools that detect IoAs have the following advantages:

They Work Against Unknown Threats

Because attack indicators focus on behavior rather than signatures, they can flag malicious activity even when the malware or technique has never been seen before. 

A zero-day exploit, for instance, will not match any known attack signature, but the behavior it triggers (e.g., a process making unusual network calls or a file being modified in a suspicious location) can still be detected through the IoA analysis.

They Catch Attackers Early In The Kill Chain

Cyberattacks follow a progression — reconnaissance, initial access, privilege escalation, lateral movement, and finally, the payload delivery or data exfiltration. 

Indicators of attack can expose suspicious behavior at the earliest stages, long before any real damage is done. Catching an attacker during reconnaissance, for example, is far less costly than catching them after they have already stolen your data.

They Provide Context For Decision-Making

One suspicious event, such as a regular user accessing an admin file, might not mean much on its own. But in the context of other indicators of attack observed around the same time — the same account logging in from an odd location and a new process spawning shortly after — it starts to tell a different story. 

They Support Regulatory Compliance

Many security frameworks and regulations require organizations to demonstrate proactive threat detection capabilities. The Detect function of the NIST Cybersecurity Framework (CSF), for one, explicitly requires organizations to implement mechanisms that identify cybersecurity events in a timely manner.

Using indicators of attack as part of a broader security program helps organizations meet those requirements and show that their defenses are built to catch threats early.

They Reduce The Cost Of A Breach

The faster a security team can identify and contain an active threat, the less damage it causes. Fewer compromised systems, less stolen data, and faster recovery times all translate directly into lower costs.

Limitations of Indicators of Attack

IoAs are a powerful tool for proactive threat detection, but they are not perfect. Understanding where they fall short helps security teams use them more effectively and avoid over-relying on any single detection method.

Below are some of the challenges security teams face when relying solely on indicators of attack.

They Rely on a Strong Baseline

Indicators of attack work by flagging deviations from normal behavior. That means you need a clear and well-established picture of what normal looks like before you can determine what is not. 

Building that baseline takes time — you need consistent monitoring across users, devices, and network segments. Organizations that are just starting out with behavioral detection, or those with highly variable environments (e.g., seasonal workforces or frequent infrastructure changes), may struggle to define a stable baseline. Without one, IoA detection won’t be as accurate.

They Depend on the Quality of Telemetry 

IoA detection is only as good as the telemetry data feeding it. If your logging is incomplete or your endpoint coverage has gaps, you may overlook some signals. And attackers who understand this actively target blind spots. They operate in areas of the environment where telemetry is lacking or insufficient. 

They Are Resource-Intensive

Deploying an IoA-based detection program and then leaving it on autopilot is a common mistake. Effective IoA hunting requires skilled analysts, mature tooling, continuous monitoring, and constant tuning. 

Detection rules need to be regularly updated as attacker techniques evolve and as the organization’s environment changes. That kind of continuous maintenance takes time and expertise that smaller security teams may not have.

They Do Not Work in Isolation

Indicators of attack are most valuable when combined with other detection methods. Relying on them alone leaves gaps in your visibility. IoCs, threat intelligence feeds, vulnerability management, and human-led threat hunting all play complementary roles. 

An attacker who moves slowly and carefully, keeping their behavior just within the boundaries of what looks normal, can sometimes evade IoA-based detection entirely. Layering multiple approaches makes that kind of evasion harder.

Attackers Are Aware of Them

Sophisticated threat actors know that security defenders use behavioral signals to detect attacks. Some actively study detection frameworks like MITRE ATT&CK to understand what triggers alerts and adjust their methods accordingly. This cat-and-mouse dynamic means IoA detection strategies need to evolve constantly, not just react to the last known attack pattern.

How to Hunt for Indicators of Attack

Threat hunting is the practice of actively searching for indicators of attack in your environment rather than waiting for an alert to fire. Here is how security teams go about it.

Establish a Baseline

Before you can detect abnormal behavior, you need to understand what normal looks like. This means profiling typical network traffic patterns, user activity, process behavior, and system configurations. A solid baseline makes anomalies stand out clearly.

Use SIEM and Behavioral Analytics

Security information and event management (SIEM) platforms aggregate logs and events from across the environment, making it easier to identify patterns. Pair that with user and entity behavior analytics (UEBA) tools, and you have a powerful combination for detecting indicators of attack that would otherwise get buried in noise.

Deploy Honeypots and Deception Technology

A honeypot is a decoy system set up to attract attackers who are already inside your network and actively probing for targets. Any activity directed at a honeypot is an immediate indicator of an attack. More sophisticated deception technologies can create a web of decoy assets that make it harder for attackers to move without triggering alerts.

Automate Where Possible and Use AI

One of the challenges when hunting for indicators of attack is volume. No security team can manually review every event, so automating the detection of known patterns frees up analysts to focus on cases that require human judgment.

AI takes this further. Machine learning models can analyze behavioral data across thousands of endpoints simultaneously, spot correlations that would take a human analyst hours to detect, and adapt to new attack patterns without waiting for a signature update. 

Some AI-powered tools also reduce false positive rates by learning what’s normal for a specific environment over time, so alerts carry more weight when they are triggered.

Map to the MITRE ATT&CK Framework and Threat Intelligence Feeds

The MITRE ATT&CK framework is a publicly available knowledge base of adversary tactics, techniques, and procedures (TTPs). Mapping your IoA detection rules to ATT&CK gives your team a structured way to think about what attackers do at each stage of an attack and what signals to look for.

Another data source you can use is threat intelligence feeds. They provide curated and up-to-date information about attacker TTPs, known malicious infrastructure, and emerging attack patterns. Feeding this data into your detection tools helps enrich IoA analysis with external context.

Where to Find Indicators of Attack Data

Several repositories and platforms aggregate indicators of attack, TTPs, and other threat data for the security community to use. Below are some of them:

• MITRE ATT&CK: This is the most widely used framework for mapping adversary behavior. As previously mentioned, ATT&CK catalogs techniques used by real-world threat actors across every stage of an attack, making it an essential reference for building IoA-based detection rules.

• Malware Information Sharing Platform (MISP): MISP is an open-source platform used by government agencies, financial institutions, tech companies, and security vendors to share threat intelligence in a structured and automated way.

• Threat Intelligence Feeds from security vendors: Companies like CrowdStrike, Palo Alto Networks, and Recorded Future offer commercial threat intelligence feeds that include curated IoA data derived from their global visibility into attack activity.

• AlienVault OTX (Open Threat Exchange): A free, community-driven threat intelligence platform where researchers and security teams share indicators of attack, IoCs, and other threat data in real time.

Key Takeaways

• Indicators of attack are real-time behavioral signals that show an attack is in progress.
• They focus on what attackers are doing, not just what tools they are using.
• They are different from IoCs — IoAs are detected during an attack, while IoCs are discovered after a breach has occurred.
• Real-world examples include unusual login patterns, masked system files, external server requests, and unexpected data transfers.
• They are valuable because they work against unknown threats, catch attackers early in the kill chain, and reduce the overall cost of a breach.
• Threat hunting for these indicators involves establishing behavioral baselines, using SIEM and UEBA tools, mapping detections to MITRE ATT&CK, and automation using AI.
• Several public repositories, including MITRE ATT&CK, MISP, and AlienVault OTX, make IoA data available to the security community for free.

Sources

• https://www.youtube.com/watch?v=D04h6cf3ar0
• https://www.cisco.com/site/us/en/learn/topics/security/what-are-indicators-of-compromise-ioc.html
• https://trainingcamp.com/glossary/indicators-of-attack/