A SOC keeps blocking malware hashes and command-and-control IP addresses from one threat group, but the group replaces them within days. The SOC lead wants detections that stay effective when those artifacts change. What should the team focus on?
Select an answer to reveal the explanation.
Short Explanation
Changing a hash takes a recompile and changing an IP takes a few clicks, but changing how you operate takes real work. Aim your detections at the group's TTPs, the top of the pyramid of pain. The trap is buying more of the same cheap indicators and expecting a different result.
Full Explanation
Indicators sit at different levels of the pyramid of pain, which ranks them by how costly they are for an adversary to change. File hashes and IP addresses are at the bottom: recompiling malware or moving infrastructure takes minutes, so detections built on them decay quickly. Tactics, techniques, and procedures describe how the adversary operates, such as the initial access method, persistence mechanism, credential dumping approach, or lateral movement tooling. Mapping observed behavior to MITRE ATT&CK techniques gives a common vocabulary and lets the SOC build behavioral detections in EDR, SIEM, and network analytics that continue to work when hashes and addresses change, because changing behavior forces the adversary to retool. Collecting more hashes repeats the losing strategy, since each new variant produces a new hash. Geographic blocking is easily evaded through cloud providers and proxies in permitted countries and can disrupt legitimate business. Shortening indicator expiry keeps lists tidy but does not detect new infrastructure the group has not used yet. Exam caveat: atomic indicators still have value for quick containment and retrospective searches; TTPs complement rather than replace them. Operational check: map the group's observed activity to ATT&CK techniques, compare against existing detection coverage, and build detections for the uncovered techniques.