← Back to Blog
January 202630 min readMethodology

The Pyramid of Pain: A Detection Engineering Perspective

Understanding adversary pain points through detection engineering, threat hunting, and AI-powered automation

#Pyramid of Pain#Detection Engineering#Threat Hunting#AI Security#MITRE ATT&CK

Introduction to the Pyramid of Pain

The Pyramid of Pain, created by David J. Bianco, is a foundational framework in cybersecurity that categorizes indicators of compromise (IOCs) based on how difficult they are for adversaries to change. Understanding this hierarchy is crucial for building effective detection strategies and maximizing the impact of your security operations.

The pyramid consists of six levels, each representing a different type of indicator. As you move up the pyramid, the indicators become more difficult for attackers to modify, causing them increasing levels of "pain" when their tactics are detected and blocked.

The Pyramid of Pain

TTPs
Tough
Tools
Challenging
Network/Host Artifacts
Annoying
Domain Names
Simple
IP Addresses
Easy
Hash Values
Trivial
↑ Increasing difficulty for adversaries to change

Key Insight: The higher you detect on the pyramid, the more resources adversaries must invest to evade your defenses. This forces them to either abandon their campaign or significantly increase their operational costs.

🚧 Article In Progress

This comprehensive guide is being developed. Check back soon for the complete article covering all pyramid levels, detection strategies, threat hunting methodologies, and AI-powered automation techniques.