Behavior-based IoC
Course: AP® Cybersecurity Shows up in: Unit 4: Securing Devices
An indicator of compromise found in authentication and access logs, such as many failed logins or attempts to elevate privileges.
Appears in the course and exam description (CED): 4.4.A.6
Why it matters in Unit 4
It is about how an account behaves, not what a file is.
Example
A standard user repeatedly trying to become administrator.
Learn it properly, with a checkpoint 4.4 Detecting Attacks on Devices