Pyramid of Pain: Why Attacker Indicators Fail to Stop Threats
Blocking surface-level indicators provides false security because attackers change them instantly, while targeting their methods forces costly operational shifts.
The Pyramid of Pain ranks threat indicators by how difficult they are for attackers to change. Low-level data like IP addresses offers minimal friction. High-level data like tools and tactics forces adversaries to rebuild their infrastructure, slowing their progress and increasing their risk of detection.
The Post Office Analogy
Imagine a thief stealing packages from your porch. You notice the delivery truck is blue. You report the blue truck to the police. The thief simply repaints the truck red. You report the red truck. The thief paints it green. This cycle continues endlessly. You are reacting to the vehicle’s color, which is easy to change. The thief’s actual method—breaking the lock and taking the package—remains untouched. The Pyramid of Pain illustrates this dynamic in cybersecurity. It categorizes threat indicators by how much effort it takes an attacker to change them. The lower you go in the pyramid, the easier it is for the adversary to adapt. The higher you go, the more painful the change for them.
Understanding the Base: Indicators of Compromise
The base of the pyramid consists of Indicators of Compromise, or IOCs. These are specific artifacts left behind by an attack, such as an IP address, a domain name, or a file hash. An IP address is a numerical label assigned to each device connected to a computer network. A file hash is a unique string of characters generated by an algorithm to identify a specific file.
These indicators are easy to collect and share. Many organizations rely heavily on blocking these values. However, this approach has a hidden cost. Attackers expect you to block these items. They change them frequently. Blocking a malicious IP address today may block a legitimate service tomorrow if the attacker uses a cloud provider that rotates addresses. This creates noise in your detection systems.
| Term | Plain meaning |
|---|---|
| IP Address | A numerical label for a device on a network |
| Domain Name | A human-readable address for a website |
| File Hash | A unique digital fingerprint of a specific file |
| TTPs | Tactics, Techniques, and Procedures used by attackers |
| Threat Intelligence | Data about threats used to improve defense |
| IOC | Indicator of Compromise, a sign of a breach |
The Middle Layer: Tools and Infrastructure
Moving up the pyramid, you encounter tools and infrastructure. This includes the specific malware variants, scripts, and command-and-control servers an attacker uses. These are harder to change than simple IP addresses. An attacker may spend weeks developing a custom backdoor. If you detect and block that specific backdoor, you disrupt their operation. They must write new code or find a different tool.
This takes time and skill. However, many groups have access to shared toolkits. If you block a popular tool, the attacker may simply switch to another one from the same repository. This layer requires deeper analysis than just checking a list of bad IPs. It often involves detection engineering to create rules that identify the behavior of the tool, not just its signature.
The Peak: Tactics, Techniques, and Procedures
The top of the pyramid represents Tactics, Techniques, and Procedures, or TTPs. These describe the attacker’s behavior and strategy. A tactic is the operational objective, such as gaining initial access. A technique is the method used to achieve that objective, such as phishing. A procedure is the specific implementation of that technique. TTPs are the hardest for attackers to change. An attacker’s methodology is shaped by their training, culture, and available resources.
Changing their entire approach requires significant retraining and operational overhaul. If you defend against their TTPs, you force them to abandon their preferred methods. This is the most effective form of defense. It requires understanding the attacker’s intent, not just their current actions. This knowledge is often shared through ISACs, which are industry-specific groups that exchange threat information.
Common Points of Confusion
Many readers confuse IOCs with TTPs. An IOC is a single data point, like a malicious URL. A TTP is a behavior, like using a legitimate email service to send phishing links. Focusing only on IOCs is like chasing the thief’s truck color. Focusing on TTPs is like securing the porch lock. Another common mistake is assuming that blocking an IOC stops an attack. It only stops that specific instance. The attacker can return with a new IOC. This is why log management is critical. You need to correlate IOCs with TTPs to see the full picture. Without context, an IOC is just a piece of data. With context, it becomes evidence of a campaign.
See also: Implementing ISACs: A Practical Framework for Shared Defense · How Detection Engineering Works: From Data to Alert
Practical Application for Small Operations
You do not need a large security team to apply this framework. Start by identifying the TTPs most relevant to your industry. Research common attack patterns for your sector. Then, configure your security tools to detect those behaviors. For example, if credential dumping is a common technique in your sector, ensure your systems alert on unusual access to credential stores.
Do not just look for known malicious files. Look for the actions that precede and follow such files. This approach is more resilient than maintaining a list of bad IPs. It also reduces alert fatigue. You are not chasing every new variant of a virus. You are looking for the consistent behavior that defines the threat.
Try This Now
- Review your current blocking lists. Identify how many entries are simple IP addresses or domains.
- Select one common TTP relevant to your business, such as session cookie theft or phishing.
- Configure your monitoring tools to alert on the behaviors associated with that TTP, not just specific indicators.
Key takeaways
- Surface indicators like hashes and IPs are easy for attackers to rotate, rendering static blocks ineffective long-term.
- Targeting tools and tactics disrupts the adversary’s workflow, forcing them to invest time and resources in new methods.
- Effective defense requires correlating multiple indicator types to identify the underlying campaign rather than isolated events.
Focus on attacker behavior rather than surface-level indicators to create lasting defense. Audit your detection rules to ensure they target TTPs, not just IOCs.
Frequently asked questions
How do I find TTPs for my industry?
Review public frameworks like MITRE ATT&CK, which maps common attacker behaviors across various sectors.
Is blocking IPs ever useful?
Yes, for immediate containment of active threats, but it should not be your primary long-term strategy.
What is the difference between a tactic and a technique?
A tactic is the goal, such as exfiltration. A technique is the method, such as using encrypted channels to move data.
Can small businesses implement TTP-based defense?
Yes, by prioritizing a few high-impact behaviors and using standard logging and monitoring tools effectively.
How this guide was produced: written by the InfoSec Ledger editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
