Why is looking for TTPs $($Tactics$,$ Techniques, and Procedures$)$ better than signatures when attempting to detect covert channels?

Choose one $1$ point

TTPs are defined by MITRE

TTPs lack ownership

Signatures are easily changed

Signatures aren$$t unique