Indicators are what attackers leave behind. Stolen credentials are what they arrive with.