IOCs

Indicators of compromise are the specifics of something already seen: a file, an address, a domain.

They are useful and they are the most disposable thing an attacker owns. Changing a domain or recompiling a file costs minutes, which is why a detection built purely on indicators is out of date almost immediately. Detections built on behaviour, what the attacker does rather than what they used, survive far longer, because changing the technique is genuinely expensive.