## Chapter 19 — T1078 does not multiply ### Learning outcomes After this chapter, you should be able to: 1. Say which finding the technique name is attached to. 2. Show that the product uses 2 and 3. 3. Refuse to treat the technique id as proof or as a score. ### 19.1 The name sits in the paragraph. The integers sit in the tuple. F3 is the shared admin account on the grading system. The prose links that condition to T1078 Valid Accounts, because a shared credential lets a person act as a legitimate user without a separate name in the log. The tuple does not store `T1078`. It stores likelihood 2 and impact 3. The product is 6, from those two integers. The ranking lambda cannot see a technique id that is not in the tuple, so renaming the technique would not move F3 relative to F1. The name is also not evidence that an intrusion occurred. It gives the detection team a public label to look up. Maya can write the label beside the finding. She cannot write it into the score, and she cannot treat it as a procedure for using the shared account. This course does not supply that procedure. | Object | Holds T1078? | Holds the product? | |---|---|---| | The F3 paragraph | Yes, as a name | No | | The F3 tuple | No | Yes, as 2 × 3 | | The sort key | No | Yes, as `-6` and then the id | ### 19.2 Worked example | Offered claim | Where the fact lives | Decision | |---|---|---| | "T1078 labels F3. The score is still 2 × 3." | Paragraph versus tuple | Keep | | "The technique id is why F3 scores 6." | The integers are why | Refuse | | "The label proves someone broke in." | A label is not an event | Refuse | > **Synthetic case.** One technique name, one product, no attack steps. ### Errors and limits Do not turn T1078 into a score or into a way to use the shared account. ### Apply - **EX065 — Name versus product.** What does T1078 do for F3, and what does it not do to the ranking? *Rubric:* 3 = it names the shared-account behaviour; the product remains 2 × 3; the id is not in the tuple and is not proof of an intrusion;; 2 = the name and the product stay separate;; 1 = one label;; 0 = none. ### Continue studying — lesson 19 (chapter 19 of 20) [← Chapter 18](#ch-18) · [Course chapter index](../SUBJECTS.md) · [Chapter 20 →](#ch-20) Continue to the next authored lesson. ## Worked answers **EX065.** T1078 names the shared-account behaviour. The product remains 2 × 3. The technique id is not in the tuple and is not proof of an intrusion.