thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Indicator of Attack (IoA)

Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.

Definition

IoAs describe sequences of actions such as an Office application spawning PowerShell that downloads and executes code, regardless of the specific file or IP used. Because they target behavior, they are harder for attackers to evade than IoCs. Vendors such as CrowdStrike build detections around IoAs.

Example

winword.exe launching powershell.exe with an encoded command and then making an outbound connection.

Exam tip

IoA = proactive, behavioral; IoC = reactive, artifact-based.

Don't confuse it with

Related terms