What Is the Pyramid Of Pain?
The Pyramid of Pain ranks indicators by attacker disruption, with TTPs causing the most pain at the top and hashes causing the least at the bottom.
The Pyramid of Pain, conceptualized by David J. Bianco, offers a strategic framework for evaluating the effectiveness of threat detection. It moves beyond simply asking ‘Can we detect this?’ to a more impactful question: ‘How much does detecting this hurt the attacker?’ This insight is crucial for prioritizing defensive efforts and understanding that not all indicators are created equal in their ability to disrupt adversaries.
Bianco introduced this model to address the need for more impactful cybersecurity defenses, particularly in the context of advanced persistent threat (APT) investigations. The core principle is that higher fidelity detections inflict more significant operational and financial pain on attackers, forcing them to expend more resources or abandon their objectives.
How It Works
The pyramid is structured into six distinct levels, ascending in difficulty of detection and increasingly imposing ‘pain’ on attackers. As defenders gain the ability to detect threats at higher levels, the adversary faces greater challenges and costs to adapt.
The levels, from bottom to top, and the pain they inflict are:
1. Hash Values (Trivial): Identifiers for files (e.g., MD5, SHA-1, SHA-256). Attackers can change these nearly instantly by recompiling malware or altering a single byte, causing minimal disruption.
2. IP Addresses (Easy): Network addresses used for command and control (C2) or delivery. While blocking an IP is straightforward, attackers can easily cycle through cloud hosts, VPNs, and proxies.
3. Domain Names (Simple): Domains used for C2 or phishing. Registration and configuration make these slightly more troublesome than IPs, but attackers use domain-generation algorithms and quick registrations to bypass blocks.
4. Network / Host Artifacts (Annoying): Distinctive indicators like User-Agent strings, URI patterns, C2 beacon intervals, registry keys, service names, or file paths created by malware. Detecting these requires attackers to reconfigure their tools, causing moderate annoyance.
5. Tools (Challenging): Specific utilities used by attackers, such as loaders, credential dumpers, or backdoors. Reliable detection of these tools (e.g., via YARA rules targeting code logic) forces attackers to find or build new ones, representing a significant setback.
6. TTPs (Tough): The fundamental tactics, techniques, and procedures that define an attacker's operational behavior. Detecting these core actions, like specific methods for credential dumping or lateral movement, requires adversaries to fundamentally alter their operational methodologies, which is time-consuming and costly, inflicting maximum pain.Real-World Example
An illustration of detection effectiveness across the Pyramid of Pain:
LOW PAIN -> You block SHA256 e3b0c442... (attacker recompiles in minutes)
LOW PAIN -> You block IP 45.32.11.8 (attacker spins up new cloud host)
MID PAIN -> You block domain evil[.]top (attacker registers evil2[.]top)
MORE PAIN -> You detect the beacon's fixed 60s interval and custom URI
/api/v2/health (attacker must retune the C2 profile)
TOP PAIN -> You detect the behavior itself:
rundll32.exe comsvcs.dll, MiniDump <pid> ... [T1003.001]
winword.exe -> powershell.exe -enc ... [T1059.001]Behavior-based detection, as seen at the top, is robust because it remains effective regardless of changes to underlying indicators. Evading such detection necessitates abandoning established methods, retraining personnel, and rebuilding tools, highlighting why TTP analysis is paramount for inflicting lasting disruption on adversaries.
Why It Matters for Defense Strategy
The Pyramid of Pain fundamentally shifts how security teams allocate resources and prioritize their detection strategies. While blocking low-level indicators like hashes and IPs is essential for swift response, their impact on deterring determined adversaries is minimal. Sustainable and effective defense hinges on ascending the pyramid towards detection of higher-level tools and TTPs. This approach aligns directly with the principles of behavior-based detection (Indicators of Attack – IOAs) and mapping TTPs to frameworks like MITRE ATT&CK.
The ultimate objective is to create an environment where the cost and complexity of attacking an organization become prohibitive, compelling threat actors to seek less challenging targets. Threat intelligence platforms, such as SOCRadar, play a vital role by enriching lower-fidelity indicators with the higher-contextual information regarding adversary tools and TTPs, thereby amplifying the ‘pain’ inflicted.
An effective analogy underscores this point: confiscating a burglar’s mask (a low-level indicator) is a minor inconvenience, as they can easily acquire another. However, making an entire neighborhood impervious to their signature methods of entry (detecting TTPs) forces them to learn entirely new criminal skills, posing a significantly greater obstacle.
People Also Ask
Who created the Pyramid of Pain? David J. Bianco, in a 2013 blog post that he updated in 2014 to add the hash-values level.
What is at the top of the pyramid, and why? TTPs. They represent attacker behavior, which is the hardest and most costly thing for an adversary to change, so detecting them causes the most pain.
How does the pyramid relate to MITRE ATT&CK? ATT&CK catalogs the TTPs at the top of the pyramid, giving defenders a structured way to detect at the most painful level.
- The Pyramid of Pain ranks cyber threat indicators by how difficult and costly they are for attackers to change.
- Detection at higher levels of the pyramid, such as TTPs, causes significantly more disruption than at the base, like file hashes.
- The goal is to make attacks prohibitively expensive and difficult for adversaries by focusing on their behaviors (TTPs).
- MITRE ATT&CK provides a framework for cataloging and detecting TTPs, the most painful indicators for attackers.
- Threat intelligence platforms enrich indicators with TTP context to enhance defensive strategies.
