- IOA:
- Indicator Of Attack
[…] refer to the series of behaviors that a cybercriminal exhibits prior to executing a cyberattack. The intent of cybercriminals may be evaluated during the research stage of the cyberattack kill chain — where they investigate potential entry points, and collect data about the company, users and technology systems in place.
Indicators of attack are not so much a static description of the attacker, but a dynamic profile of how an attacker interacts with your technologies and users.
https://www.splunk.com/en_us/blog/learn/ioa-indicators-of-attack.html