Study. uk . com
  1. Home
  2. All questions
  3. Question 446

CompTIA Security+ study material · question 446 of 611

Why does behaviour-based detection built on ATT&CK techniques outlast an indicator feed?

  1. Because ATT&CK techniques are updated daily
  2. Because hashes and addresses age quickly while the underlying technique persists
  3. Because behaviours are easier to detect than hashes
  4. Because indicator feeds are proprietary
Show the answer

Answer: B. Because hashes and addresses age quickly while the underlying technique persists

An adversary changes infrastructure cheaply but changes their way of working far less often.

Challenge yourself on this topic → Study as cards