IOA: Indicator of Attack in Cybersecurity
IOA stands for Indicator of Attack. An IOA describes active attacker behaviors and techniques rather than static artifacts. IOAs focus on what an attacker is trying to do, such as credential dumping or privilege escalation, regardless of the specific tools used.
How IOA Is Used in Cybersecurity
Threat hunters use IOAs to build behavioral detection rules that catch attackers even when they change their tools. SOC analysts correlate IOAs with MITRE ATT&CK techniques to classify the stage of an ongoing attack. Security engineers write detection logic based on IOAs to identify threats that signature-based tools miss.
Read the full glossary entry: Indicators of Attack in Cybersecurity
Cybersecurity Roles That Work with IOA
Related Cybersecurity Acronyms
Frequently asked questions
What does IOA stand for?
IOA stands for Indicator of Attack. An IOA describes active attacker behaviors and techniques rather than static artifacts. IOAs focus on what an attacker is trying to do, such as credential dumping or privilege escalation, regardless of the specific tools used.
What is IOA used for in cybersecurity?
Threat hunters use IOAs to build behavioral detection rules that catch attackers even when they change their tools. SOC analysts correlate IOAs with MITRE ATT&CK techniques to classify the stage of an ongoing attack. Security engineers write detection logic based on IOAs to identify threats that signature-based tools miss.
Sources
Definitions are original explanations written for career development purposes. For authoritative technical definitions, refer to NIST, ISO, or the relevant standards body.