Which option describes indicators of attack?

Indicators of Attack (IoAs) focus on the behaviors and intent of an attacker, signaling an active intrusion is in progress. Malware that reinfects a system minutes after removal is a definitive sign of a persistence mechanism. This demonstrates that an adversary is actively working to maintain access and control over the compromised system. This focus on the attacker's actions (maintaining persistence) is the core characteristic of an IoA, as opposed to a static artifact left behind after an event.

A. spam emails on an employee workstation Spam is a common delivery vector for potential threats but is not, by itself, an indicator of an active, ongoing attack.
B. virus detection by the AV software A virus detection is a classic Indicator of Compromise (IoC), an artifact proving a compromise occurred, not necessarily that an attack is currently in progress.
C. blocked phishing attempt on a company A blocked attempt is a record of a prevented attack. It indicates that security controls worked successfully, not that there is an ongoing intrusion.

1. Santos

O. (2020). CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Chapter 3

"Cybersecurity Threats

Vulnerabilities

and Attacks

" Section: "Maintaining Access." This section describes how attackers establish persistence using techniques like rootkits

trojans

and other backdoors to ensure they maintain access even if the system is rebooted or the initial vulnerability is patched. The scenario in option D is a direct example of an active persistence mechanism

which is a behavioral Indicator of Attack.

Chapter 13

"Fundamentals of Intrusion Analysis

" Section: "Indicators of Compromise." This section defines IoCs as "artifacts observed on a network or in an operating system that with high confidence indicate a computer intrusion." It lists examples like virus signatures and hashes

which align with option B

distinguishing them from the behavioral nature of an IoA.

2. Cisco. (2023). What Is an Indicator of Attack (IOA)?. Cisco Umbrella Documentation.

This official Cisco documentation states

"Unlike indicators of compromise (IOCs) which are reactive

IOAs are proactive... IOAs focus on detecting the intent of what an attacker is trying to accomplish

regardless of the malware or exploit used in an attack." The rapid reinfection described in option D clearly points to the attacker's intent to maintain persistence

fitting the definition of an IoA.