Fix Your Pyramid of Pain: 6 Common Misreadings
High-value indicators like TTPs require far more effort to produce than hashes, yet they offer longer-term defensive value against adaptive adversaries.
The Pyramid of Pain maps the cost an attacker pays to change an indicator. Low-level data like file hashes is cheap to swap, making it ineffective for long-term defense. Focus on behaviors and infrastructure that are hard for threat actors to abandon.
Misreading: The Pyramid Is a Hierarchy of Value
Many readers assume the top of the pyramid contains the "best" indicators and the bottom contains "bad" ones. This implies you should ignore the bottom layers entirely. That is a dangerous simplification.
Correct reading: Every layer has value, but the value differs in duration and scope. The bottom layers, such as file hashes, are excellent for immediate containment. They tell you exactly which file to delete right now. The top layers, such as Tactics, Techniques, and Procedures, are valuable for long-term resilience. They tell you how to detect the next campaign, even if the files change. You need both. You use the bottom to stop today’s infection. You use the top to prepare for tomorrow’s variant.
Misreading: Hashes Are Useless Because They Are at the Bottom
Because file hashes sit at the base of the model, some security teams dismiss them as low-value noise. They argue that since an attacker can change a hash by adding a single byte, blocking hashes is futile. This view ignores the operational reality of incident response.
Correct reading: Hashes are vital for the initial phase of incident triage. When you detect a known malicious file, you need a precise identifier to quarantine it immediately. A hash provides that precision. It does not help you predict future attacks, but it stops the current one. Do not discard hashes; use them to buy time while you investigate the higher-level behaviors that delivered the file.
Misreading: IPs and Domains Are Always Worth Blocking
Network defenders often hoard lists of IP addresses and domain names. They believe that blocking these indicators cuts off the attacker’s communication. The problem is that these indicators are cheap for the attacker to replace.
Correct reading: An adversary can register a new domain or rent a new IP address in minutes. Blocking a single IP often does nothing if the attacker has thousands of others. These indicators are useful for short-term disruption, but they do not break the adversary’s campaign. Focus on the pattern of communication rather than the specific address. Look for unusual ports, protocols, or data volumes. These behaviors are harder to change than the address itself.
Misreading: Tooling Should Prioritize High-Value Indicators
Security teams often build automation that prioritizes complex, high-level data. They want their systems to automatically detect tactics and techniques. This is technically difficult and often leads to false positives. Low-level indicators are easier to automate.
Correct reading: Automation works best with low-level data. You can easily scan millions of files for a specific hash or check a connection against a blocklist of domains. Detecting a complex tactic requires context and human analysis. Use your tools to filter the noise at the bottom. Then, let your analysts focus on the top. Do not try to automate the entire pyramid. Automate the collection and correlation of low-level data to support the analysis of high-level data.
Misreading: The Pyramid Applies Only to External Threats
Some readers view the Pyramid of Pain as a framework for analyzing external cybercrime groups. They forget that internal threats and insider risks follow similar patterns of behavior. The model is often treated as purely external.
Correct reading: The model applies to any adversary, including insiders. An insider might use a specific script to exfiltrate data. The hash of that script is a low-level indicator. The method of exfiltration is a high-level indicator. If you only block the script hash, the insider can write a new one. If you detect the exfiltration pattern, you catch the behavior regardless of the tool. Apply the pyramid to internal monitoring as well as external threat intelligence.
See also: Tactical Threat Intelligence Explained: Actionable Indicators for Defense
Misreading: You Can Jump Straight to TTPs
A common ambition is to skip the lower layers and focus entirely on Tactics, Techniques, and Procedures. The logic is that TTPs are the hardest for attackers to change, so they are the most valuable. This ignores the data required to identify TTPs in the first place.
Correct reading: You cannot identify a TTP without first observing the lower-level indicators. You need the hash, the IP, and the domain to understand what the attacker is doing. These lower layers provide the evidence that proves the high-level behavior exists. Without the bottom layers, your TTP analysis is just theory. Build your detection capabilities from the bottom up. Collect the raw data, then layer on the behavioral context. This ensures your high-level insights are grounded in real evidence.
Misreading: The Pyramid Is Static
Some treat the Pyramid of Pain as a fixed set of categories. They assume the layers will never change or expand. This rigid view prevents adaptation to new attack methods.
Correct reading: The pyramid is a framework, not a rigid law. New types of indicators emerge as technology evolves. For example, cloud configuration states or API keys might represent new layers of pain. As an attacker changes their infrastructure, the cost of changing certain indicators shifts. Stay flexible. Re-evaluate which indicators cause the most pain to your specific adversaries. The model helps you think about cost and effort, not just categorize data.
Consider how this relates to attacker persistence techniques. Persistence mechanisms often rely on low-level indicators like scheduled tasks or registry keys. However, the method of establishing persistence is a TTP. If you only block the specific task name, you fail. If you detect the method of adding tasks, you succeed. This distinction highlights why understanding the pain points matters.
Similarly, when dealing with DCSync attacks, the IP address used is irrelevant. The technique of requesting directory replication is the key. Blocking the IP does nothing. Detecting the request type stops the attack. This is a classic example of focusing on the wrong layer.
Threat actor profiling also benefits from this view. Understanding who an actor is helps predict their TTPs. But without the lower-level evidence, the profile is just a guess. Use the pyramid to ground your profiling in observed reality.
SOC teams often use SOAR platforms to automate responses. These platforms excel at handling low-level indicators. They can block IPs and delete files quickly. However, they struggle with high-level TTPs. Use SOAR to handle the bottom of the pyramid. Reserve the top for human analysts who can understand context and intent.
Dark web monitoring can provide early warnings of stolen credentials or tools. These are often low-level indicators. Use them to inform your TTP analysis. If you see a new tool for sale, anticipate the techniques it enables. This proactive approach uses the pyramid to stay ahead.
IOC enrichment adds context to raw indicators. A hash becomes more valuable when linked to a known malware family. A domain becomes more valuable when linked to a specific campaign. Enrichment moves indicators up the pyramid. It transforms raw data into actionable intelligence.
Threat actor naming conventions help track groups over time. But names change, and groups merge. The TTPs remain more stable than the names. Focus on the behavior, not the label. The pyramid reminds you that behavior is the hard part for an attacker to change.
Misreading: Pain Is Only About Cost
The model suggests that high-level indicators cause the most pain because they are expensive to change. But pain is also about disruption. Even cheap indicators can cause significant disruption if blocked effectively.
Correct reading: Cost is not the only factor. Timing matters. Blocking a command-and-control domain for an hour can disrupt an attack significantly, even if the attacker registers a new domain later. The goal is to create friction. Every layer adds friction. The top layers add the most long-term friction. The bottom layers add immediate friction. Use the full range of indicators to maximize disruption.
Key takeaways
- Indicators of Compromise vary wildly in the effort required for an adversary to replace them.
- High-level indicators force attackers to redesign their operations, not just swap a single file.
- Defenders must balance the ease of automation with the strategic value of the intelligence.
Focus on indicators that force the adversary to change their behavior, not just their tools. Start with low-level data for immediate containment, then escalate to high-level analysis for long-term defense.
Frequently asked questions
How do I know which indicators are high-pain?
High-pain indicators are behaviors or infrastructure that require significant effort to recreate. Examples include custom protocols, unique code structures, or specialized infrastructure.
Should I stop collecting low-level indicators?
No. Low-level indicators are necessary for immediate response and for building the context needed to identify high-level behaviors.
Can I automate TTP detection?
Partially. You can automate the detection of specific techniques, but understanding the tactic and intent usually requires human analysis.
Does the Pyramid of Pain apply to cloud environments?
Yes. Cloud configurations, IAM roles, and API usage patterns can be mapped to the pyramid layers based on how hard they are to change.
How this guide was produced: written by the CloudSec Press editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
