Using the Pyramid of Pain, how should a city SOC weight a file hash from technical intel versus a tactic from tactical intel?
Select an answer to reveal the explanation.
Short Explanation
Burning a hash is changing a license plate; changing a tactic is learning to drive a different car. Keep the plates in the threat list, but put more weight on detections that catch the driving style. Both matter — the tactic hurts them more.
Full Explanation
Using the Pyramid of Pain, a city SOC should use both a file hash from technical intel and a tactic from tactical intel, but weight tactic matching higher because hashes are easy for the adversary to burn. Civic framing matters because municipal defenders often over-index on hash feeds; the pyramid explains why ATT&CK-oriented detections create more lasting pain for actors targeting city systems.
Weighting hashes highest because they never change fails by concept: hashes change with trivial rebuilds and sit low on the pyramid. Discarding tactical intel because ATT&CK cannot be detected in Splunk fails by concept: Splunk ES can encode behavioral and technique-oriented detections; ATT&CK is not undetectable. Using only hashes and ignoring tactics so notables stay simple fails by concept: simplicity that ignores durable TTPs leaves the SOC blind after daily hash churn.
Exam caveat: SPLK-5001 Pyramid of Pain items expect both tiers in play with higher weight on TTPs—do not claim hashes are immutable or that tactics cannot be detected.
Operational check: Keep hashes in threat lists for cheap hits, prioritize correlation and risk rules that map to the relevant ATT&CK tactics for civic endpoints, and review notable quality after hash-only versus TTP-weighted coverage.