What is IOA?

IOAs represent a deliberate shift from artifact-based detection to behavior-based detection. An IOC tells you what an attacker left behind: a specific file hash, a specific IP address. An IOA tells you what an attacker had to do to accomplish their objective, and that is much harder to change. An attacker who wants credentials has to interact with LSASS memory, the Windows process that holds them, in one of a fairly small number of ways, whether they use Mimikatz, a custom tool, or a built-in Windows utility repurposed for the same job. That interaction pattern is the IOA, and it stays detectable even after the attacker rotates every hash and domain in their toolkit.

Common IOA patterns an analyst will see tagged in an EDR or XDR console include: an unusual parent-child process relationship, such as a web server process spawning a command shell; code executing in memory with no corresponding file ever written to disk; a scripting engine like PowerShell running a base64-encoded command block, a common obfuscation technique; and a process that has no legitimate reason to make outbound network connections suddenly doing so. None of these require a known-bad hash or IP to detect. They are flagged purely on the shape of the behavior.

IOA-based detection is the core logic underneath most modern EDR and XDR platforms, and it is also the organizing principle behind the MITRE ATT&CK framework. Each ATT&CK technique is effectively a documented IOA: a named, structured description of a behavior that is detectable independent of the specific tooling an adversary chooses to implement it with. That structure is why security teams can map their detection coverage against ATT&CK and identify which behaviors they can see and which they cannot, regardless of how many individual malware families or campaigns those behaviors show up in.