Which order of steps best ensures detections reflect threat actor TTPs in GTI?

• A. Identify exposed technologies used by your org and develop detections for signs of exploitation.
• B. Find intelligence reports in GTI related to the threat actor and use past behavior to design detections.
• C. Export IOCs for the threat actor into a SecOps list and develop detections referencing the list.
• D. Review the threat actor's TTPs in GTI and design detections based on those TTPs in SecOps.

Answer: (D)

The central idea is to base detections on how an attacker operates, not just on isolated indicators or past reports. In GTI, threat actor TTPs describe the concrete techniques and methods the actor uses—how they gain initial access, move laterally, persist, execute, evade defenses, and exfiltrate data. By first reviewing those TTPs in GTI, you capture the full spectrum of the actor’s behavior. Then translating that into SecOps detections ensures your rules trigger when those techniques appear in real activity, even if the attacker changes tools, domain names, or IOIs. This creates detections that are more durable and activity-focused, covering the ways the actor operates rather than just the artifacts they leave behind.

Relying on IOCs or past reports alone can lead to gaps: IOCs are often ephemeral and easy for attackers to change, and past reports may not reflect current campaigns or evolving techniques. Focusing on the actor’s TTPs provides a robust, behavior-based detection approach that stays relevant as the threat landscape shifts.