@DaveMWilburn@infosec.exchange
Post #4068204
2026-07-24 17:08 UTC
@mttaggart@infosec.exchange my personal experience has been that, at least during incident response, narrowing down the universe of possible TTPs down to the ones most commonly used by a specific, attributed threat actor helps focus and speed up incident scoping and response in critical ways. It's less helpful in general defense, but absolutely critical in time-sensitive breach response.
Replies (1)
-
@mttaggart@infosec.exchange 2026-07-24 17:09
@DaveMWilburn@infosec.exchange I have a similar experience but if I examine it closely, the who does not matter. I find relevant threat intelligence that describes a similar campaign. Great. I then hunt for those TTPs. At no point does attribution impact my defensive posture.