If Indicators of Compromise (IOCs) are the clues left behind at the scene of the crime, Indicators of Behavior (IOBs) are the witnesses, and they tell a story. For investigating a cyber attack, both are useful.
Article Link: Leveraging Indicators of Behavior for Early Detection