Understanding IOAs
Determined adversaries can discover vulnerabilities in software applications and code used in the target system. Zero-day exploits and other malware-free attacks present less or no evidence in the monitoring tools or logs; hence, it becomes difficult for monitoring tools to capture their presence. The question is, How can your organization know that it is under attack when there is no IOC alert?
IOAs focus on proactive security by detecting the adversary's intent. Contrary to IOCs that represent pieces of evidence of an attack or breach, IOAs relate to the steps and actions that an adversary must undertake to compromise a system. While there are so many explanations of IOAs, the most straightforward understanding is that IOAs are real-time indicators that sit at the tactics and techniques level of the TTPs. Instead of focusing on the procedures used by the adversaries, you focus on the adversary's behavior. Behavioral IOCs are close to IOAs, focusing...