The gunmen who massacred more than 300 worshippers in an Egyptian mosque made no effort to conceal their identity, authorities and witnesses said.
They showed up raising the black banner of the "Islamic State of Iraq and Syria" (ISIS), having previously warned the North Sinai mosque associated with Sufis to end the mystical practices ISIS calls heretical.
They even visited the mosque in person a few weeks prior, a Sufi sheikh said.
But almost a week after the Friday massacre, ISIS has yet to claim the attack in a sign, officials and analysts say, that their gunmen might have gone too far even by the extremists' standards.
Despite all the indiscriminate carnage ISIS has perpetrated on almost every continent, this attack has shocked even its supporters.
As the scale of the attack was made known in extremist social media channels, pro-ISIS users denied the group's involvement.
Every militant group known to operate in Egypt, including al-Qaeda-linked Jund al-Islam in Sinai, condemned the massacre.
ISIS supporters on social media were livid when a purported audio recording of wireless communications between an ISIS element boasting about the attack, and another noting down details, spread on pro al-Qaeda social media channels.
A shift in modus operandi
ISIS had targeted mosques before -- usually Shia -- and Sufis.
But the attack on the Egyptian mosque, packed during Friday prayers with hundreds of worshippers, Sufis and non-Sufis, appears to have been a step too far for ISIS supporters.
At least 27 children died in the massacre.
"Something of this scale, that killed more than 'just Sufis' would be hard to justify," said analyst Amarnath Amarasingam, senior research fellow with counter terrorism group ISD Global.
ISIS affiliate Wilayat Sinai has over the past year killed hundreds of security personnel in attacks, and more than a hundred Christians in church bombings and shootings.
The Friday attack "does appear to be in line with a gradual shift over the last four years", said a Western official, who spoke on condition of anonymity.
ISIS went "from a violent campaign by the terrorists in Sinai that was very local... and in the beginning careful not to alienate the local population... to something that seems to be much more affected by global jihadi motivations," the official said.
No central agreement
It is "possible that the attack was co-ordinated without central agreement. Hence the absence of a claim," said a Western diplomat, also speaking on condition of anonymity.
Another possibility is that it was an attack meant to send a message to Sufis and villagers seen as pro-government, without granting it the imprimatur of an official ISIS claim.
Hassan Hassan, a leading expert on ISIS, said the group had called the Sufis "taghuts" in a publication, a word used in the Qur'an to describe the devil and tyrants.
"Nothing is off limits when they call them taghut," said Hassan, a senior fellow at the TIMEP think tank and author of the book "ISIS: Inside the Army of Terror".
ISIS fighters, however, had gone too far in the past and been punished for it, he said.
"When they killed the al-Shaitat, they removed the (attackers) after that," he said of a 2014 massacre of up to 700 tribesmen in Syria's Deir Ezzor region.
This was "either because they wanted to distance themselves from it or they thought they went too far", Hassan said.
Still, with ISIS's media operation continuing to baffle observers, it remains possible but unlikely that the group may yet claim the attack.
After an attack on a military toll booth south of Cairo in June, ISIS issued a claim three weeks later -- not through the usual statement on its social media accounts, but in its weekly al-Nabaa newsletter.