A threat intelligence team explains that a file hash matching a known malware sample is a static artifact left behind after compromise, whereas observing a sequence of unusual PowerShell execution followed by registry modification and scheduled task creation represents an evolving behavioral pattern that can be detected while the attack is still unfolding. Which term describes this second, behavior-based concept?
- AIndicator of Attack (IOA)
- BThreat actor attribution profile
- CTactic, Technique, and Procedure (TTP) database entry
- DIndicator of Compromise (IOC)
Show answer & explanationAnswer & explanation
Correct answer: A. Indicator of Attack (IOA)
An Indicator of Attack (IOA) focuses on the sequence of adversary behaviors and intent (e.g., execution chains, persistence attempts) observed in real time, enabling detection before compromise is fully complete, whereas an Indicator of Compromise (IOC) is a static, after-the-fact artifact such as a file hash or known-bad IP. TTP entries in a knowledge base catalog general adversary behaviors rather than describing a specific live detection pattern, and attribution profiles identify the responsible threat actor rather than describing the behavior itself.
Why the other options are wrong
- B. Attribution profiles identify who the attacker is, not the behavior pattern being observed.
- C. A TTP catalog entry documents general adversary methods, not a specific real-time behavioral detection.
- D. IOCs are static, post-compromise artifacts like hashes, IPs, or domains, not behavior chains.
Indicator of Attack (IOA)
A behavior-based signal representing the sequence of actions and intent an adversary exhibits during an attack, enabling detection of malicious activity in progress rather than only after compromise has occurred.
- Focuses on process chains and behavior, not static artifacts
- Can detect novel/unknown malware based on behavior alone
- Contrasts with IOC, which is a static artifact tied to a known threat
Memory trick: 'IOC is the footprint left after the burglar leaves; IOA is watching him pick the lock.'