One bulletin says a crew targeting city halls "uses scheduled tasks and signed binaries for persistence." Another gives a single SHA-256. How should the analyst classify those two pieces?
Select an answer to reveal the explanation.
Short Explanation
How they work is the playbook; the hash is the jersey number on one jersey. Scheduled tasks plus signed binaries are tactical TTPs, while a SHA-256 is a technical IoC that dies when they recompile — do not swap those labels.
Full Explanation
One bulletin says a crew targeting city halls "uses scheduled tasks and signed binaries for persistence." Another gives a single SHA-256. The analyst should classify scheduled tasks and signed binaries as tactical TTPs and the hash as technical indicator intelligence. Civic framing matters because city-hall endpoints see frequent hash churn; method-level TTPs remain useful for detection design after a single sample's hash is burned.
Calling both strategic intelligence for the county board fails by concept: strategic intel addresses intent and long-horizon trends, not persistence methods or a file hash. Saying scheduled tasks and signed binaries are technical IoCs while the hash is tactical fails by concept: it inverts the tiers—TTPs are tactical methods, and a SHA-256 is a technical observable. Requiring both to be loaded only as Enterprise Security annotations that fire notables fails by concept: annotations are metadata on detections and do not by themselves fire notables from bulletin text.
Exam caveat: SPLK-5001 expects clear separation—tactical = how they operate (TTPs), technical = specific IoCs like hashes—do not swap those labels on civic intel tickets.
Operational check: Map scheduled-task and signed-binary TTPs to correlation or risk detections for city-hall hosts, load the SHA-256 into the threat list as a technical IoC, and document both tiers distinctly in the intel case.