Precursor

An observable event or sign that indicates an attacker may be preparing to launch a cyberattack.

"The unusual login attempts were a precursor to the larger attack that followed."