The Pyramid of Pain ranks the things defenders can detect by how much trouble it causes an attacker when they are caught. Hash values are at the bottom and cost the attacker almost nothing to change. Behaviors, called tactics, techniques and procedures, are at the top and are the hardest to replace.
Where it comes from
David Bianco published it on his blog on 1 March 2013 and updated it on 17 January 2014 to add the hash level. It remains a common way to explain why not all indicators are equal.
The six levels, bottom to top
- Hash values. Change one bit of a file and the hash changes. Bianco calls them very accurate for an exact file, but often not worth tracking.
- IP addresses. Attackers can switch them whenever they like, often through anonymous proxies, so blocking one usually causes little disruption.
- Domain names. A bit harder, since domains must be registered, paid for and hosted. Cheap or free DNS makes replacement fairly easy.
- Network and host artifacts. Distinctive traces such as an unusual User-Agent string or malware specific registry keys. Detecting these forces the attacker to work out how they were caught and fix their tools.
- Tools. Blocking a specific tool means the attacker must find or build a replacement and learn it. Signatures and detection of distinctive protocols apply here.
- TTPs. Detecting behavior, such as pass the hash attacks seen in Windows logs, forces the attacker to learn new behaviors. Do it across many techniques and they must give up or reinvent themselves.
How to use it
Do not throw away low level indicators. Hashes and addresses are cheap to match, they are useful for scoping an incident, and they sometimes catch lazy attackers. The point is to avoid stopping there.
A practical rule: for each detection in your library, label the level it targets. If the list is mostly levels one to three, you are chasing the attacker's last campaign. Aim to grow levels four to six over time.
An example of climbing
Suppose a report names a malicious address. Blocking it is level two. Asking what the malware did on the host, and finding a distinctive registry change, is level four. Asking which technique that change supports, and writing a rule for the behavior regardless of tool, is level six. Each step takes more effort to write and lasts longer.
Trade offs
Behavior detections produce more false positives at first, because normal admin work can look similar. They need tuning and testing. Atomic indicators are precise but short lived. A healthy program mixes both.
Quick check
Are IP blocklists useless?
No. They are cheap and sometimes effective. They are just easy for an attacker to route around, so they should not be your only layer.
Where does MITRE ATT&CK fit?
It gives a shared vocabulary for the top level. Mapping a detection to a technique makes it clear which behavior it covers.
Sources
Last reviewed: 19 October 2026.
