The city's threat-intel program loads only file hashes into Enterprise Security. Actors targeting clerk PCs change hashes daily. What should the SOC do?
Select an answer to reveal the explanation.
Short Explanation
Hashes go stale like milk. Keep the feed — it still catches last night's sample — but pair it with detections that watch how they work, like persistence or signed-binary tricks. A city that only loads SHA-256s will miss tomorrow's rebuild of the same malware.
Full Explanation
The city's threat-intel program loads only file hashes into Enterprise Security, yet actors targeting clerk PCs change hashes daily. The SOC should pair perishable hash feeds with tactical ATT&CK-style detections that survive hash churn. Civic framing matters because clerk workstations are frequent municipal phishing targets; a hash-only program will miss rebuilt samples of the same persistence and execution methods the next day.
Stopping collection because hashes are useless fails by concept: hashes still catch known samples and related infrastructure matches—they are perishable, not worthless. Replacing all detections with a single perimeter firewall rule fails by concept: one network rule cannot cover endpoint TTP diversity or identity abuse on civic hosts. Briefing only the county board and skipping detections entirely fails by concept: strategic briefings do not substitute for technical matching and tactical detections in ES.
Exam caveat: SPLK-5001 Pyramid-of-Pain style reasoning expects defenders to keep cheap IoCs while investing in higher-pain TTP detections—do not abandon hashes or pretend board briefings replace them.
Operational check: Keep the hash feed in the ES threat-intelligence framework, add or tune detections for persistence and signed-binary behaviors on clerk PCs, and measure catch rate after daily hash churn rather than declaring intel useless.