I am also using these behavior codes for indicator icons for Protection Warriors.
Sunder Armor Indicator Icon:
return IconMAura("HARMFUL", "target", "Sunder Armor", "Faerie Fire", "Expose Armor", "Tear Armor", "Corrosive Spit")
Thunder Clap Indicator Icon:
return IconMAura("HARMFUL", "target", "Thunder Clap", "Waylay", "Judgements of the Just", "Infected Wounds", "Icy Touch", "Earth Shock", "Tailspin", "Dust Cloud")
Demoralizing Shout Indicator Icon:
return IconMAura("HARMFUL", "target", "Demoralizing Shout", "Demoralizing Roar", "Demoralizing Screech", "Curse of Weakness", "Scarlet Fever", "Vindication")
Rend Indicator Icon:
return IconAura("HARMFUL", "target", "Rend", "player")
Thunderstruck Indicator Icon:
return IconAura("HELPFUL", "player", "Thunderstruck", "player")
And these buff indicator icons:
Commanding Shout Indicator Icon:
return IconMAura("HELPFUL", "player", "Commanding Shout", "Blood Pact", "Power Word: Fortitude", "Quraji Fortitude")
Battle Shout Indicator Icon:
return IconMAura("HELPFUL", "player", "Battle Shout", "Horn of Winter", "Roar of Courage", "Strength of Earth")
I used the MMO-Champion raidcomp tool to find the name of spells with the same effects as our shared buffs/debuffs; I have not verified that the aura names all work, I generally assumed the aura name matached the spell name.