## Indicators: IOCs vs IOAs

In Cyber Threat Intelligence, an **Indicator** is a piece of information that suggests a potential compromise or attack. But not all indicators are created equal.

### 1. Indicators of Compromise (IOC)
Evidence that a breach has **already occurred**. These are static artifacts.
*   **The "Forensic" Approach**.
*   **Examples**:
    *   **MD5 Hash**: `a1b2c3d4...` (A known malware file).
    *   **IP Address**: `192.168.1.5` (A known C2 server).
    *   **Domain**: `update-microsoft-support.com` (A phishing site).
*   **Use Case**: You load these into your Firewall/EDR to **Block** bad things.
*   **Weakness**: They are easy to change. An attacker can change a file hash in 1 second by adding a null byte.

### 2. Indicators of Attack (IOA)
Evidence of the **intent** or **behavior** of an attack in progress.
*   **The "Real-time" Approach**.
*   **Examples**:
    *   **Lateral Movement**: A user logging into 50 servers in 1 minute.
    *   **Credential Dumping**: Accessing the `lsass.exe` process memory.
    *   **Persistence**: Creating a Scheduled Task named "Updater" that runs a script in `C:Temp`.
*   **Use Case**: You write behavioral rules (SIEM/EDR) to detect the *technique*, not the specific file.
*   **Strength**: Behaviors are hard to change. If an attacker wants to dump credentials, they *must* touch memory somehow.

---

### The Pyramid of Pain
Created by David Bianco, this concept illustrates how much pain you cause the adversary when you deny them each indicator type.

1.  **Hash Values (Trivial)**: Attacker just recompiles. NO PAIN.
2.  **IP Addresses (Easy)**: Attacker rents a new VPS. LOW PAIN.
3.  **Domain Names (Simple)**: Attacker registers a new domain. LOW PAIN.
4.  **Network / Host Artifacts (Annoying)**: e.g., "User Agent String". Attacker must recode their tool. MEDIUM PAIN.
5.  **Tools (Challenging)**: e.g., "Mimikatz". If you detect the *tool*, they must write a new one. HIGH PAIN.
6.  **TTPs (Tough!)**: Tactics, Techniques, and Procedures. If you detect *how* they behave (e.g., "Pass the Hash"), they have to relearn how to hack. **MAXIMUM PAIN**.