A county SOC rewrites detections every time a ransomware encryptor hash changes. What Pyramid of Pain lesson should guide more durable civic detections?
Select an answer to reveal the explanation.
Short Explanation
Hashes are cheap Halloween costumes—the actor swaps them overnight. Technique-oriented detections chase the method, which sits higher on the Pyramid of Pain and lasts after the encryptor gets a new paint job.
Full Explanation
The Pyramid of Pain teaches that indicators at the bottom (hash values, IP addresses) are easy for adversaries to change, while behaviors higher up—tools, techniques, and tactics—cost the adversary more to alter. A county SOC that rewrites detections every time a ransomware encryptor hash changes should aim detections at techniques so coverage survives procedure and tool churn. Technique-oriented civic detections chase methods such as inhibit recovery, remote service creation, or valid-account abuse, which persist after the encryptor gets a new paint job.
Aiming detections only at MD5 hashes fails by sitting at the bottom of the pyramid, not the top—hashes are the cheapest costume for the actor to swap. Dropping technique mapping to keep one procedure signature per civic department locks the SOC into brittle, department-siloed signatures that break on the next binary. Treating tactics as "too stable to detect" so hash-only rules become the durable layer inverts the pyramid's lesson: stability at the tactic/technique layer is exactly why behavioral detections endure.
Exam caveat: know which pyramid tier hashes occupy versus techniques; distractors often mis-state that hashes sit at the top or that tactics cannot guide detection.
Operational check: inventory county ransomware rules that key solely on encryptor hashes, rewrite or supplement them with technique-based correlation searches (annotated in ES), and measure whether a lab encryptor with a new hash still produces notables.