Overview
The Pyramid of Pain is one of the most fundamental concepts in modern cyber threat intelligence (CTI) and SOC operations. Introduced by security researcher David J. Bianco in 2013, it illustrates the relationship between the types of indicators of compromise (IOCs) you use to detect an adversary and the amount of pain you cause the attacker when you deny them those indicators.
The core philosophy is simple: Not all threat intelligence is created equal. Blocking some indicators forces an attacker to spend five seconds changing a line of code, while blocking others forces them to spend six months redesigning their entire toolkit.
The 6 Layers of the Pyramid (Bottom to Top)
The pyramid is arranged from the easiest indicators to block at the bottom, to the hardest and most painful at the top.
1. Hash Values (Base Level)
What they are: Unique cryptographic fingerprints (MD5, SHA-1, SHA-256) assigned to specific files.
Analyst Effort to Block: Trivial. You drop the SHA-256 hash into your EDR or SIEM, and any matching file is blocked.
Pain Caused to Attacker: None.
Why? If an attacker changes a single byte, space, or character in their malware code, the hash changes completely. Attackers automate this (using compilers or polymorphic code) to generate thousands of unique hashes per minute.
SOC Takeaway: Hashes are great for blocking known, static threats, but useless against sophisticated, active adversaries.
2. IP Addresses
What they are: The numerical network addresses (e.g.,
192.0.2.1) used by attackers' Command and Control (C2) servers or proxy networks.Analyst Effort to Block: Easy. You drop the IP into a firewall rule or IP-blocklist.
Pain Caused to Attacker: Negligible.
Why? IPs are cheap and disposable. Attackers use compromised home routers (botnets), bulletproof hosting services, or dynamic cloud instances (AWS/Azure) that let them spin up a new IP address in seconds.
3. Domain Names
What they are: The human-readable web addresses (e.g.,
malicious-login-update.com) pointing to the attacker's infrastructure.Analyst Effort to Block: Simple. Block the domain via DNS sinkholing or Web Proxy filters (like the Splunk proxy query we wrote earlier).
Pain Caused to Attacker: Slight.
Why? Registering a domain requires buying it, setting up DNS records, and waiting for propagation. While harder than swapping an IP, attackers use DGA (Domain Generation Algorithms) to register hundreds of backup domains automatically.
4. Network / Host Artifacts
What they are: The distinct traces left behind on the network or endpoint by the attacker's tools.
Network Artifacts: Custom User-Agent strings in HTTP requests, unique URI paths, or specific TLS certificate hashes.
Host Artifacts: Specific registry keys, distinct file names, or unique mutexes created in system memory.
Analyst Effort to Block: Moderate. Requires configuring NIDS (Network Intrusion Detection Systems like Snort/Suricata) or YARA rules on the endpoint.
Pain Caused to Attacker: Annoying.
Why? The attacker has to go back to their source code, modify how their tool communicates or behaves on the OS, recompile it, and re-deploy it. This costs time and engineering effort.
5. Tools
What they are: The software, utilities, or scripts the attacker uses to carry out their objective (e.g., Mimikatz for password dumping, Cobalt Strike for C2 navigation, or PsExec for lateral movement).
Analyst Effort to Block: Challenging. Requires robust EDR rules and behavioral monitoring.
Pain Caused to Attacker: Challenging.
Why? If you detect and block their primary weapon (like neutralizing Cobalt Strike beacon signatures across your network), the attacker cannot just "tweak a setting." They must source, test, and master a completely different toolset or write their own custom software from scratch.
6. TTPs: Tactics, Techniques, and Procedures (The Apex)
What they are: How the adversary operates from end to end—their operational habits, behaviors, and strategies (e.g., using Spearphishing Attachments to gain access, followed by LSASS Memory Dumping for credentials, and PowerShell for execution). These are codified in the MITRE ATT&CK Framework.
Analyst Effort to Block: Hard. Requires deep hunting, custom analytics, SIEM correlation, and mature SOC workflows.
Pain Caused to Attacker: Tough / Severe.
Why? TTPs represent the attacker's muscle memory and skill set. If you detect and block their core technique—for example, rendering credential dumping via LSASS impossible through OS hardening and EDR rules—you force the attacker to re-learn how to attack. They must invent entirely new attack vectors, which requires months of research, development, and training.
How a SOC Uses the Pyramid of Pain
Automate the Bottom: Never spend human analyst time manually looking up MD5 hashes or single IPs. Let your SIEM and SOAR platforms consume threat intelligence feeds to auto-block the bottom three layers.
Focus Humans on the Top: Your Tier 2/3 analysts and Threat Hunters should focus their time mapping behaviors to TTPs and detecting tools in the EDR. That is how you drive up the cost of an attack and make your organization an unappealing target.
Summary Table
| Level | Indicator Type | Example | Detection Mechanism | Attacker Impact |
|---|---|---|---|---|
| Apex | TTPs | Credential Dumping via LSASS | EDR Behavioral Rules / MITRE Mapping | Severe (Forces re-learning) |
| High | Tools | Cobalt Strike, Mimikatz | AV/EDR Signatures & Memory Scans | Challenging (Requires new tools) |
| Mid-High | Host/Network Artifacts | Specific Registry Keys / User-Agent | YARA Rules / IDS Signatures (Snort) | Annoying (Requires code changes) |
| Mid | Domain Names | evil-phishing-site.com |
DNS Sinkholing / Web Proxy Filters | Slight (Requires new domains) |
| Low | IP Addresses | 185.220.101.5 |
Firewall ACLs / IP Reputation | Negligible (New IP in seconds) |
| Base | Hash Values | 44d88612fea8a8f36de82e1278abb02f |
File Reputation / Blacklists | Trivial (Changes completely) |
Top comments (0)