Two ransomware crews hitting city hall both phish, use valid accounts, then encrypt, but they use different lure text and encryptors. How should the industry regard those TTPs?
Select an answer to reveal the explanation.
Short Explanation
Same playbook, different jerseys. Phish, valid accounts, encrypt is a reusable pattern—the lure wording and encryptor hash are just this week's procedure, not a brand-new sport.
Full Explanation
Industry practice treats TTPs as reusable behavioral patterns. When two ransomware crews hitting city hall both phish, abuse valid accounts, then encrypt, those shared tactics and techniques remain the same playbook even though lure text and encryptor binaries differ as procedures. Civic SOCs and ISACs therefore hunt and detect on the common behaviors—phishing delivery, Valid Accounts, Inhibit System Recovery, Data Encrypted for Impact—while treating each crew's lure wording and file hash as perishable procedure detail.
Reducing TTPs to unique hashes fails by concept: when the encryptor hash changes, the behavioral pattern is not a new attack class; only the procedure layer moved. Treating TTPs as a single civic incident number that cannot be reused across crews confuses case management identifiers with adversary behavior vocabulary. Claiming Kill Chain stages forbid mapping the same technique to more than one actor invents a restriction that neither Kill Chain nor ATT&CK impose—multiple actors routinely share techniques.
Exam caveat: distinguish reusable tactics/techniques from unique procedures and IoCs; exam distractors often equate "different hash" with "different TTP set."
Operational check: build city-hall detections and hunt packages around phishing, valid-account abuse, and encryption behaviors annotated with ATT&CK techniques; enrich with each crew's lure and hash as secondary IoCs without rewriting the core technique coverage when a new encryptor appears.