Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOCs with confidence of 50% or more associated with ER