What is Indicators of Attack (IOA) (IOA)?
Indicators of Attack (IOA) is a concept in threat detection that describes behavioral patterns signaling an attack is actively in progress, regardless of the specific malware or tools used. IOAs focus on what an attacker is doing, such as executing code in memory or escalating privileges, rather than on known malicious file signatures.
What it is
An Indicator of Attack (IOA) is a behavioral signal observed during an active attack. It describes the actions an attacker takes: running a process that spawns a shell, reading credential stores, moving laterally across a network, or injecting code into a running process. IOAs are independent of the specific malware family or exploit used. The same IOA pattern can appear whether the attacker uses a known ransomware strain or a brand-new, never-seen-before tool.
This contrasts with Indicators of Compromise (IOC), which are forensic artifacts left after an event, such as a known malicious file hash, a suspicious IP address, or a registry key written by malware. IOCs look backward. IOAs look at what is happening right now.
Why it matters
Attackers regularly change file hashes, rotate infrastructure, and use living-off-the-land techniques that leave no malware on disk at all. A detection system that relies only on IOCs will miss these attacks entirely. IOAs catch the behavior regardless of the tool. For example, a process that reads the Windows LSASS memory space is suspicious whether or not the executable matches a known credential-dumping tool. Detecting that behavior in real time gives defenders a chance to stop an attack before data is exfiltrated or systems are encrypted.
How tools address it
Endpoint Detection and Response (EDR) platforms are the primary place where IOA detection is implemented. An EDR agent on a host records process creation, file access, network connections, and memory operations. The platform then applies behavioral rules or models to identify IOA patterns in that telemetry. Some agents, like those focused on in-memory code execution or ransomware containment, are built specifically around IOA-style detection rather than signature matching. Workload protection tools apply similar behavioral logic to cloud and server workloads. Endpoint Protection Platforms (EPP) increasingly incorporate IOA logic alongside traditional signature scanning.