The Pyramid of Pain: why behavior-based detections outlast indicator lists

The levels

David Bianco’s Pyramid of Pain ranks indicator types by how much it hurts an adversary when defenders detect them. From bottom to top: hash values, IP addresses, domain names, network and host artifacts, tools, and tactics, techniques, and procedures (TTPs). Changing a hash takes seconds; changing how an operation works takes real effort.

Using each level

Hashes and IPs are still useful for quick blocking and for scoping a known incident, but they expire quickly. Artifacts such as specific registry paths, named pipes, or user-agent strings last longer. Detections built on behavior, such as Office applications spawning script interpreters or credential dumping tools opening LSASS, catch new variants of the same technique.

Lab: rewrite an indicator as a behavior

Take a threat report about a phishing campaign that lists a file hash, two IPs, and a domain, and describes the behavior: a document macro launches mshta.exe, which downloads a script. Write a hash-based rule and a behavior-based rule. Then imagine the attacker recompiles the payload and changes infrastructure, and note which rule still fires.

Snippet

# indicator rule (expires quickly)
FileHash == "<sha256 from report>" or RemoteIP in ("192.0.2.10", "198.51.100.20")

# behavior rule (Sigma-style)
detection:
  selection:
    ParentImage|endswith: ['\winword.exe', '\excel.exe', '\powerpnt.exe']
    Image|endswith: ['\mshta.exe', '\wscript.exe', '\cscript.exe', '\powershell.exe']
  condition: selection

Threat feeds in practice

Ingest indicator feeds with expiry dates, so stale IPs age out instead of causing false positives on reassigned addresses. Use intel reports mainly for the behaviors they describe, and turn those into detections.

Diagram

Pyramid of Pain, bottom to top

Higher means harder for the adversary to change.

Hash values
Trivial to change.
IP addresses
Easy to change.
Domain names
Simple to change.
Network and host artifacts
Annoying to change.
Tools
Challenging to change.
TTPs
Tough: requires changing how they operate.

Check yourself

1. Which level of the Pyramid of Pain is hardest for an adversary to change?

2. Which indicator type is easiest for an attacker to change?

3. Which rule is most likely to keep working after the attacker changes infrastructure?