Determining usable artifacts for detection involves understanding:

Question

Options

• AOnly the malware hash values
• BThe full range of attacker behaviors
• CJust the IP addresses used
• DSolely the domain names involved

• A
  6% (3)
• B
  71% (34)
• C
  6% (3)
• D
  17% (8)

Explanation

Identifying usable artifacts for detection requires understanding the full range of attacker behaviors (B) because defenders need to map the complete attack lifecycle - tactics, techniques, tools, infrastructure, and indicators - to build detections that are both comprehensive and resilient. Relying solely on hash values (A) fails because attackers trivially recompile malware to change hashes, making that single artifact fragile and short-lived as a detection mechanism. IP addresses (C) and domain names (D) are similarly narrow: they represent only network-layer indicators that rotate frequently, leaving defenders blind to behavior-based patterns like lateral movement, privilege escalation, or data staging.

Memory tip: Think of it as the "Pyramid of Pain" (David Bianco's model) - hash values and IPs sit at the bottom (easy for attackers to change), while TTPs (tactics, techniques, procedures) sit at the top (hardest for attackers to change). "Full range of attacker behaviors" maps directly to TTPs - the most valuable and durable detection artifacts.

No community discussion yet for this question.