Overview

The Pyramid of Pain is one of the most fundamental concepts in modern cyber threat intelligence (CTI) and SOC operations. Introduced by security researcher David J. Bianco in 2013, it illustrates the relationship between the types of indicators of compromise (IOCs) you use to detect an adversary and the amount of pain you cause the attacker when you deny them those indicators .

The core philosophy is simple: Not all threat intelligence is created equal. Blocking some indicators forces an attacker to spend five seconds changing a line of code, while blocking others forces them to spend six months redesigning their entire toolkit .

The 6 Layers of the Pyramid (Bottom to Top)

The pyramid is arranged from the easiest indicators to block at the bottom, to the hardest and most painful at the top .

1. Hash Values (Base Level)

What they are: Unique cryptographic fingerprints (MD5, SHA-1, SHA-256) assigned to specific files.

Analyst Effort to Block: Trivial.…