Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
helpdesk.com
it.com
itdesk.com