IOA

Definitions

Short for indicator of attack, a behavioral sign that an adversarial technique or stage of intrusion is occurring, even if the exact malware or infrastructure is unknown. IOAs emphasize attacker actions like suspicious process chains or credential access patterns rather than static artifacts alone.
In plain English: A behavioral clue that an attack is happening.
Example: "The alert was based on an IOA for unusual token theft behavior, not a known malware signature."