IOA

IOAs are behavioral patterns that indicate an attack in progress, rather than evidence of a past compromise. Unlike IOCs (which look for known-bad artifacts), IOAs detect suspicious sequences of actions — like a process spawning a shell, then enumerating users, then connecting to an external IP — regardless of the specific tools used.

IOA-based detection is more effective against novel malware and living-off-the-land attacks.