A municipal SOC is documenting an LSASS dump on a finance workstation. How should the analyst label the three TTP layers?
Select an answer to reveal the explanation.
Short Explanation
Goal, method, recipe. Credential Access is why they showed up, OS Credential Dumping is how, and the exact malware-plus-LSASS command is the one-off recipe on that finance PC.
Full Explanation
TTP language has three nested layers. For an LSASS dump on a municipal finance workstation, tactic is the adversary goal—Credential Access; technique is the method class—OS Credential Dumping (for example T1003); procedure is the specific malware family, dump tool, and command line observed on that civic host. Keeping the three layers distinct lets the SOC share durable technique coverage with peers while still capturing the one-off recipe for forensics and detection engineering.
Calling the malware hash the tactic, the finance VLAN the technique, and the MITRE tactic ID the procedure inverts every layer: hashes and VLANs are artifacts or network context, not ATT&CK tactics, and tactic IDs are not procedures. Collapsing tactic, technique, and procedure into three names for the same hash fails by erasing hierarchy—IoCs sit below TTPs and change when the actor recompiles. Mapping tactic to Splunk sourcetype, technique to CIM model, and procedure to notable urgency confuses data plumbing and urgency with adversary behavior language.
Exam caveat: when a stem asks how to label the three TTP layers, map goal → method → specific recipe; never map infrastructure fields or ticket urgency into those slots.
Operational check: on the finance workstation notable, record Credential Access as tactic, OS Credential Dumping as technique, paste the exact dump command and tool name as procedure in the investigation notes, and ensure the ES annotation on the detection reflects the technique—not the VLAN or sourcetype.