thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Pyramid of Pain

A model by David Bianco ranking indicator types by how much pain denying them causes the adversary.

Definition

From bottom to top: hash values (trivial), IP addresses (easy), domain names (simple), network/host artifacts (annoying), tools (challenging) and TTPs (tough). Detecting higher-level indicators forces attackers to change behavior, not just infrastructure.

Example

Blocking a hash is trivial for attackers to evade, but detecting their credential dumping technique forces them to change tradecraft.

Exam tip

TTPs are at the top (most pain); hashes at the bottom.

Related terms