> Empirically, it appears that hackers are simply people. These groups seem to have maybe just one or a handful of talented individuals at their core, and they

> Empirically, it appears that hackers are simply people. These groups seem to have maybe just one or a handful of talented individuals at their core, and they all have habits they like to return to. Sure,that's why Indicators of compromise exist to begin with. What I don't get is this notion of a "high quality" indicator. You would normally match on all indicators you have. I mean,why match with a dozen indicators knowing full well the attacker might reuse any one of the hundreds of indicators that exist? All the big name security companies match against all known indicators for a group. What practical benefit is there to limiting yourself to a few indicators,even if they are top notch indicators?