Recognized action, specific, generalized, or theoretical, that an adversary might be expected to take in preparation for an attack.
Source(s):
CNSSI 4009-2015
A technical artifact or observable that suggests an attack is imminent or is currently underway, or that a compromise may have already occurred.
Source(s):
NIST SP 800-150
under Indicator
A sign that an incident may have occurred or may be currently occurring.
Source(s):
NIST SP 800-61 Rev. 2
under Indicator