Remember, back in the days, when the anti-virus vendors looked with derision at some of their competition, exclaiming “But they are using just SIGNATURES. Our tool detects BEHAVIOURS”. That was like 15 years ago. Fast forward to today, with many of the same vendors now selling “threat intelligence feeds” for good money, and the most frequent attributes pushed over these feeds are MD5/SHA1 hashes and IP addresses. The main thing that changed is that we now call these items “IOCs” (Indicators of Compromise) instead of “signatures”, but they still mostly are what they always were: Binary fingerprints that are very easy for an attacker to change.
Article Link: https://isc.sans.edu/diary/rss/26624