Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is Indicator of attack (IOA)?
An indicator of attack is evidence that an attacker is actively trying to compromise a system, identity, application, or network. Unlike a static sign of compromise, an IOA focuses on attacker behavior, such as privilege escalation, credential misuse, lateral movement, suspicious process execution, or command-and-control activity.
IOAs help security teams detect intent and technique before damage is complete. In threat intelligence and hunting, they are valuable because they map closely to adversary tactics, techniques, and procedures rather than only known malicious files or IP addresses.
Indicator of Attack vs Indicator of Compromise
An indicator of attack and an indicator of compromise are related, but they answer different questions. IOAs ask, “What is the attacker trying to do?” IOCs ask, “What evidence shows a compromise may already have happened?”
| Type | What it reveals |
|---|---|
| Indicator of attack | Active attacker behavior, intent, and technique |
| Indicator of compromise | Artifacts or traces left after suspicious or malicious activity |
For example, a known malware hash is an IOC. A user account suddenly attempting unusual remote logins, followed by privilege changes and discovery commands, is closer to an IOA because it reflects an attack pattern in motion.
Why IOAs matter in threat hunting
IOAs help defenders move from reactive detection to behavior-based defense. Attackers can change file names, domains, tools, and infrastructure quickly. Their objectives and techniques are harder to hide.
Common IOA examples include:
- Repeated failed logins followed by a successful login from an unusual location
- Suspicious PowerShell or script execution on an endpoint
- Unexpected privilege escalation or new admin account creation
- Internal scanning from a workstation that does not normally perform scans
- Unusual data access shortly before outbound transfer activity
These signals become stronger when correlated across endpoints, identities, applications, and network activity. A single event may be benign; a sequence of behaviors can reveal an attack chain.
How security teams use IOAs
Security teams use IOAs to build detection logic, guide investigations, and prioritize alerts. Threat hunters often align IOAs with frameworks such as MITRE ATT&CK to understand which adversary technique may be unfolding.
For organizations managing distributed endpoints, tools such as Hexnode can support this visibility by helping enforce device compliance, control risky configurations, and reduce unmanaged endpoint exposure. IOA-driven security works best when endpoint context, identity behavior, and policy enforcement are connected.
What makes a good IOA?
A useful IOA is specific enough to detect meaningful behavior but broad enough to catch variations of the same attack technique. It should describe suspicious intent, not just one artifact.
Good IOAs usually include context such as user role, device type, normal behavior, timing, and sequence of actions. This reduces false positives and helps analysts decide whether an event is routine, risky, or actively malicious.
FAQs
Yes. Many IOAs involve legitimate tools used in suspicious ways, such as abnormal admin commands, credential misuse, or unauthorized remote access.
Yes. Even when a vulnerability or payload is unknown, attacker behaviors such as discovery, escalation, persistence, and lateral movement may still be detectable.
