Traditional threat intelligence feeds built on Indicators of Compromise (IOCs) are losing ground against modern adversaries who abuse trusted, built-in system tools instead of dropping malware; an approach known as "Living-off-the-Land" (LOTL). The fix for sophisticated security teams is to pivot detection strategy from static, reactive indicators toward mapping adversary Tactics, Techniques, and Procedures (TTPs) using frameworks like MITRE ATT&CK.

Why IOCs Are Failing

IOCs known bad IP addresses, file hashes, or malware signatures are inherently backward-looking; they only flag threats that have already been identified and cataloged elsewhere. This model breaks down against LOTL attacks, in which adversaries use legitimate, pre-installed binaries such as PowerShell, WMI, or PsExec (collectively called LOLBins) to execute their operations, leaving no malicious file or hash for a signature-based tool to detect. Because there is no unique file signature, no custom malware, and no obviously malicious IP in many stages of the attack, traditional feeds essentially have nothing to alert on, allowing attackers to blend into normal administrative activity for extended periods.sentinelone+2

This detection gap has real consequences: LOTL attacks allow adversaries to persist within networks, move laterally, and exfiltrate data while masquerading as legitimate system administrators. Security researchers note that identifying LOTL activity requires contextual analysis across multiple data sources, including command executions, file interactions, and process lineage, rather than a simple match against a blocklist.

The Pyramid of Pain Problem

Security analysts often reference the "Pyramid of Pain" to explain why IOCs are the weakest layer of threat intelligence: hashes and IPs are trivial for attackers to change, so blocking them causes minimal disruption to an adversary's operation. TTPs sit at the top of that pyramid because they represent an attacker's actual behavior and tradecraft, something far harder and more costly to alter. When defenders detect using IOCs, they are chasing an ever-shifting set of artifacts; when they detect using TTPs, they are targeting the fundamental way an adversary operates, which tends to remain consistent across campaigns.

What Changes With MITRE ATT&CK

The MITRE ATT&CK framework reframes detection around 11 core enterprise tactics covering everything from initial access through command and control, paired with hundreds of documented techniques that describe how those tactics are executed in the real world. Each technique entry includes context such as required permissions, target platforms, and, critically, detection guidance describing the telemetry and behavioral patterns analysts should monitor. This turns threat intelligence into a living map of adversary behavior rather than a static blocklist, and it gives red and blue teams a shared vocabulary for describing and testing against real-world attack patterns.

For CISOs, this shift matters operationally in several ways:

• ATT&CK supports proactive threat hunting by enabling analysts to search for behavioral patterns (e.g., unusual WMI or PowerShell usage) rather than waiting for a known-bad indicator to trigger an alert.

• It enables gap analysis: mapping existing detections against the ATT&CK matrix reveals which adversary techniques an organization's tools would actually catch and which they would miss entirely.

• It standardizes incident response and threat reporting, since analysts across the industry describe the same behaviors using the same technique IDs, improving intelligence sharing.

• It supports adversary emulation, where red teams model specific threat-actor TTPs to validate whether monitoring and response capabilities hold up under realistic conditions.

Detecting Behavior, Not Signatures

Effective LOTL defense depends on Indicators of Attack (IOAs); behavioral patterns such as unusual parent-child process relationships or abnormal use of administrative tools, rather than on static IOCs. Resources such as the LOLBAS project catalog list native binaries that are commonly abused and map them directly to relevant ATT&CK techniques, giving defenders a bridge between "this tool is suspicious" and "this maps to technique X used by threat group Y". Combining this behavioral telemetry with EDR/XDR platforms that correlate process, command-line, and network activity enables analysts to detect an attack chain that never triggers a signature-based alert.

Building a TTP-Centric Program

Shifting strategy starts with mapping current detection coverage against the ATT&CK Navigator to visualize which techniques are monitored, partially covered, or entirely blind. From there, organizations can prioritize detections around techniques most associated with threat actors targeting their sector, then validate those detections through red team exercises that emulate real adversary behavior. This isn't a replacement for IOC feeds entirely; IOCs still add value for known, widely distributed threats—but the primary defense against sophisticated, LOTL-style intrusions must rest on behavioral, TTP-driven detection.

Stop chasing IPs and hashes that attackers change in seconds. Defa3 maps threat actor behavior to MITRE ATT&CK, exposing Living-off-the-Land attacks hiding in plain sight.

Contact us at info@defa3.com for a free security assessment with the Defa3 team today.

FAQ