📖 What is Pyramid of Pain?
The Pyramid of Pain is a conceptual model that ranks indicators of compromise based on how difficult they are for an adversary to change. It ranges from Hash Values (trivial) at the bottom to TTPs (tough) at the top of the pyramid.
"The goal of a defender is to move up the pyramid; forcing an attacker to change their TTPs causes them the most operational pain and cost."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Pyramid of Pain?
- ▸ Hash Values are the most trivial indicators because attackers can bypass them by making a single-bit change to a file's binary code.
- ▸ Network and Host Artifacts include registry keys or specific file paths, requiring attackers to modify their malware's internal behavior to avoid detection.
- ▸ Tools represent the software used by attackers; forcing a change here requires the adversary to learn new tools or develop custom software.
- ▸ TTPs (Tactics, Techniques, and Procedures) are the most difficult to change, as they represent the ingrained behavioral patterns and operational habits of the attacker.
- ▸ The defender's strategic goal is to move up the pyramid, increasing the operational cost and effort required for the attacker to remain successful.
🎯 How does Pyramid of Pain appear on the CS0-003 Exam?
You may be asked to identify which indicator of compromise (IoC) would cause the most significant operational disruption to an advanced persistent threat (APT) group.
A scenario might describe a defender blocking an IP address, only for the attacker to immediately switch IPs; you must identify why this is a trivial level of pain.
Expect questions where you must categorize a specific artifact, such as a unique User-Agent string or a specific mutex, into its correct level on the pyramid.
❓ Frequently Asked Questions
Why are hash values considered 'trivial' for attackers to change?
Attackers can use polymorphism or simply change one byte of a file to generate a completely different hash, bypassing simple hash-based blocklists almost instantly without changing the file's function.
How does the Pyramid of Pain relate to the MITRE ATT&CK framework?
The top of the pyramid, TTPs, maps directly to MITRE ATT&CK. While the bottom levels focus on static indicators, MITRE ATT&CK provides the vocabulary to describe the behavioral patterns at the peak.
Is it a mistake to focus on the bottom of the pyramid?
No, hashes and IPs are still useful for automated, high-volume blocking and initial triage. However, relying on them exclusively fails to stop sophisticated adversaries who rotate infrastructure frequently.