Indicators of Compromise (IOCs) are pieces of information that suggest a security breach or malicious activity on a system. IOCs include file hashes, IP addresses, domain names, and other characteristics typically associated with malicious activity. Security teams use IOCs to detect and respond to incidents and proactively search for threats within their networks.

Indicators of Attack (IoAs) are patterns of activity that suggest a potential security breach or malicious activity on a system. Unlike IOCs, which rely on specific data points or characteristics to detect threats, IoAs focus on the behavior or actions taken by an attacker. IoAs can include actions like privilege escalation, lateral movement within a network, or attempts to exfiltrate data.

Signature-based detection relies on a database of known threat signatures to identify and block malicious activity. This approach is effective against known threats but may not detect new or evolving threats. In contrast, zero-day protection identifies and blocks unknown or previously unseen threats. This approach utilizes advanced technologies such as behavioral analysis, artificial intelligence, and machine learning to detect anomalous activity and potential indicators of attack.