Skip to main content

Security+ — Part 5: Indicators of Attack (IOAs)

Jason J. Boderebe
4 min read
#security-plus #indicators-of-attack #threat-detection #siem #cybersecurity #mitre-attck #blue-team
Security+ — Part 5: Indicators of Attack (IOAs)

Welcome Back!

Indicators of Compromise (IOCs) tell you something bad already happened. Indicators of Attack (IOAs) tell you something bad is happening right now — and that distinction matters. IOAs are behavioral, intent-focused signals that show up during an attack before full compromise or exfiltration occurs. Catching them early is what separates reactive security from real detection engineering.

This is Part 5 of the Security+ series. Full notes on GitHub.

Indicators of Reconnaissance Activity

These signs show an attacker is collecting information about the target environment — before they’ve even tried to get in.

What to look for:

  • External port scanning across subnets
  • DNS lookups and zone transfer attempts
  • Crawling of public-facing websites and employee pages
  • Email enumeration and metadata harvesting
  • WHOIS queries or OSINT gathering on IP ranges

How to detect it:

  • Rate-limit queries and scans at the perimeter
  • Block known scanning IP ranges
  • Enable DNSSEC and configure zones to restrict transfers
  • Obfuscate or hide email addresses on public pages

Indicators of Access Attempts

Evidence that an attacker is actively trying to get in.

Behavior patterns:

  • Brute-force login attempts — many failures from a single source
  • Credential stuffing using known breach datasets
  • Exploitation of unpatched service vulnerabilities
  • Login attempts using default or common credentials
  • Use of legacy or deprecated protocols (Telnet, SMBv1)

Detection:

  • Correlate failed-login events in your SIEM
  • Alert on any use of legacy protocols
  • Monitor for anomalous privileged-account access outside business hours

Indicators of Persistence

Once access is gained, attackers install mechanisms to maintain control — even if the initial foothold is discovered and closed.

Techniques to watch for:

  • Creation of unauthorized local or domain accounts
  • Registry or startup folder modifications
  • Unusual scheduled tasks or cron jobs
  • New or altered services running under SYSTEM
  • Presence of tools like reverse shells or Cobalt Strike beacons

How to catch it:

  • Baseline and monitor all startup entries
  • Use EDR to detect credential-store access
  • Alert on nonstandard parent-child process relationships (e.g., Word → PowerShell)

Indicators of Defense Evasion

Evidence that the attacker knows they’re being watched and is trying to stay hidden.

Common tactics:

  • Disabling antivirus or EDR components
  • Modifying or clearing event logs (wevtutil, Clear-EventLog)
  • Executing PowerShell with obfuscated or base64-encoded commands
  • DLL side-loading or proxy execution via legitimate binaries
  • Living Off the Land — using signed Windows tools for malicious purposes

Mitigation:

  • Deploy Sysmon with Event Forwarding to a central SIEM
  • Enforce Windows Defender Application Control (WDAC)
  • Correlate threat intelligence feeds with process execution logs

Indicators of Exfiltration or Impact

The endgame — data theft or service disruption.

Signs to track:

  • Spikes in outbound traffic to unrecognized IPs or unusual regions
  • Use of uncommon ports or protocols (DNS tunneling, ICMP exfiltration)
  • Archiving tools (7-Zip, WinRAR) invoked in nonstandard directories
  • File renaming or encryption patterns consistent with ransomware
  • Sudden shutdowns, reboots, or service failures

Mitigations:

  • DLP policies with content inspection at egress points
  • Zero-trust network access (ZTNA) with strict outbound ACLs
  • Analyze network flows (NetFlow, Zeek)
  • Monitor cloud egress points for anomalous activity

Summary

PhaseExample IndicatorDetection Strategy
ReconnaissanceRepeated DNS lookups or port scansFirewall/IDS logs
Access AttemptsBrute-force login from foreign IPSIEM correlation rules
PersistenceNew account created during off-hoursEDR and Active Directory monitoring
Defense EvasionTermination of antivirus processesEDR behavioral analytics
Exfiltration/ImpactOutbound archive to unlisted IPDLP + anomaly detection

If you want to see how these IOAs translate into actual Splunk queries, Splunk Part 3 walks through building ATT&CK-aligned searches for exactly these kinds of behaviors — PowerShell execution, brute force, and more.

Part 6 covers data types, classifications, and security models

Stay Curious!