How the Pyramid of Pain Dictates Your Detection Strategy

The Cost of Change for Adversaries

You likely monitor your systems for specific signs of intrusion. These signs are called indicators of compromise. Not all indicators are equal. Some cost an attacker almost nothing to change. Others force them to rewrite their code, retrain their staff, and abandon their infrastructure. This disparity is the core mechanic of the Pyramid of Pain.

The model was created to help defenders understand the effort required to disrupt an attack. It is not a hierarchy of importance. It is a hierarchy of friction. The lower you look, the easier it is for the adversary to adapt. The higher you look, the more painful the adaptation becomes for them.

Stage 1: Hash

The base of the pyramid is the file hash. A hash is a mathematical representation of a file’s contents. If you change even one bit of the file, the hash changes completely. This makes hashes precise but fragile.

Imagine you block a malware executable because its hash matches a known bad entry. The attacker recompiles the code with a single extra space. The hash changes. Your block fails. This is why relying solely on hashes is a losing battle. It is a cat-and-mouse game where the mouse changes its fur color every second.

You can use hashes for immediate containment. If you know a file is bad, block it. But do not expect this to stop a determined adversary. They will regenerate their payloads faster than you can update your blocklists. This is why detection engineering must look beyond static file properties.

Stage 2: IP Address

The second layer involves Internet Protocol addresses. These are the numeric labels assigned to devices on a network. Attackers use these addresses to host their command and control servers.

Blocking an IP address is slightly more difficult for an attacker than changing a hash. They must acquire a new server or rotate their proxy network. However, this is still trivial. They can rent a new virtual machine in minutes. They can use compromised legitimate servers to hide in plain sight.

If you rely only on IP blocking, you are playing defense against a fluid opponent. They will simply move their operations to a new address. You will see a drop in alerts, but the threat remains. This is a common trap in log management where noise reduction is mistaken for threat elimination.

Stage 3: Domain Name

Domain names are the human-readable addresses of websites. Attackers register these to communicate with their malware. Blocking a domain is more painful for the attacker than blocking an IP.

They must register a new domain, configure DNS records, and wait for propagation. This takes time and money. However, domain generation algorithms can create thousands of new domains automatically. They can also use typosquatting to mimic legitimate sites.

This layer offers a slight increase in friction. You gain a window of opportunity to detect and block before the new domain is fully operational. But you must be fast. The attacker’s automation is often faster than your manual review process.

Stage 4: Tool

The fourth layer identifies the specific tools used by the attacker. This includes custom malware, scripts, or hacking frameworks. Recognizing a tool is more durable than recognizing a hash or IP.

The attacker must rewrite their tool to bypass detection. This requires development effort. They must test the new tool to ensure it still works. This slows them down. However, they can still modify the tool’s behavior slightly to evade signature-based detection.

This is where threat intelligence platforms become valuable. They aggregate data from many sources to identify known tools. You can use this data to update your detection rules. But remember, a new tool can appear tomorrow. You must be ready to adapt.

See also: What Is MITRE ATT&CK Framework Used For: Practical Defense Mapping · Network Scanning Explained: How Attackers Map Your Digital Perimeter

Stage 5: Technique

The fifth layer focuses on the technique. This is the method used to achieve a goal. For example, the technique of credential dumping involves extracting password hashes from memory.

Blocking a technique is harder for the attacker. They must find a new way to dump credentials. This might require new code or a different approach. This is significantly more painful than changing a hash or IP.

You can detect techniques by looking for behavioral patterns. For example, a process reading memory from another process is a common sign of credential dumping. This detection remains valid even if the attacker changes their tool or IP. This is a key principle in detection engineering. Focus on the action, not the artifact.

Stage 6: Tactics

The sixth layer is the tactic. This is the strategic goal of the action. For example, the tactic of lateral movement involves moving from one system to another.

Blocking a tactic is very difficult for the attacker. They must change their entire strategy. This might require a new campaign or a different target. This is the most painful layer for the attacker.

You can detect tactics by correlating multiple events. For example, a user logging into multiple systems in a short time might indicate lateral movement. This detection is robust. It works regardless of the tools or techniques used. This is why ISACs share tactical information. It helps defenders understand the adversary’s goals.

Stage 7: Infrastructure

The top of the pyramid is infrastructure. This includes the hosting providers, communication channels, and operational security used by the attacker.

Identifying infrastructure is the most difficult task for the defender. It requires deep investigation and correlation. However, it is the most rewarding. Disrupting an attacker’s infrastructure forces them to rebuild their entire operation.

This is where threat intelligence platforms excel. They correlate data from many sources to identify infrastructure. You can use this data to block the attacker’s entire network. This is the highest form of defense. It forces the attacker to start from scratch.

Reading the Pyramid for Defense

You should not aim to defend every layer equally. The lower layers are too noisy and too easy for attackers to change. Focus on the upper layers. These provide more durable protection.

Start by identifying the tactics and techniques used in your environment. Then, look for the tools and infrastructure that support them. This top-down approach is more efficient. It forces the attacker to expend more resources to bypass your defenses.

Do not ignore the lower layers entirely. Use them for immediate containment. But do not rely on them for long-term protection. They are too fragile. This is a key insight in detection engineering. Balance speed with durability.

Key takeaways

• Low-level indicators expire quickly because attackers can regenerate them in seconds.
• High-level indicators remain valid for years because changing them breaks the attacker's workflow.
• Focusing only on hashes creates a false sense of security that collapses under minor changes.

Frequently asked questions

Why is the hash layer considered the least painful for attackers?

Because changing a file hash requires only a minor modification to the file, which attackers can do instantly and at no cost.

Can I detect tactics without advanced tools?

Yes, by correlating basic log events and understanding normal user behavior, you can identify unusual patterns that indicate specific tactics.

How does infrastructure disruption help my organization?

It forces the attacker to rebuild their operational base, buying you time to improve defenses and reducing the frequency of attacks.

Is the Pyramid of Pain still relevant today?

Yes, the fundamental principle that strategic changes are harder for attackers than tactical ones remains true regardless of technology shifts.

How this guide was produced: written by the InfoSec Ledger editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.