Indicators of Attack

Signals that focus on attacker behavior and intent, the actions and techniques being carried out, rather than static artifacts. They detect attacks in progress even when no known indicator of compromise is present.