Pyramid of Pain — Why Behavioral Detections Cost Adversaries More

David Bianco’s Pyramid of Pain (2013) is one of the most useful mental models in detection engineering. It answers a question that every detection team faces: “given limited engineering time, what type of detection creates the most durable value?”

The Six Levels

          ╔═══════════════════════════════╗
          ║    TTPs (Tactics, Techniques) ║  ← Most painful to change
          ╠═══════════════════════════════╣
          ║           Tools               ║
          ╠═══════════════════════════════╣
          ║    Network/Host Artifacts     ║
          ╠═══════════════════════════════╣
          ║       Domain Names            ║
          ╠═══════════════════════════════╣
          ║       IP Addresses            ║
          ╠═══════════════════════════════╣
          ║        Hash Values            ║  ← Least painful to change
          ╚═══════════════════════════════╝

Level 1: Hash Values (Trivial to change)

# Hash-based detection
detection:
  selection:
    Hashes|contains: 'MD5=7353F60B1739074EB17C5F4DDDEFE239'

Evasion time: Minutes. Repack with UPX, change one byte, recompile.

Still useful for: Blocking known-bad tools quickly (EDR quarantine on first execution), retrospective hunting after an incident.

Not useful for: Preventing a motivated attacker — they recompile before the second attempt.

Level 2: IP Addresses (Trivial → Easy to change)

Alert: Outbound connection to 185.220.101.5 (known Tor exit node)

Evasion time: Minutes. New server, new IP. CDN fronting makes IPs meaningless against sophisticated actors.

Still useful for: High-volume commodity threats (ransomware C2, botnet callbacks), enrichment for triage.

Level 3: Domain Names (Easy to change)

Alert: DNS query to evil-c2-domain.com

Evasion time: Hours. Register new domain, update DNS records.

Still useful for: Detecting less sophisticated attackers who reuse infrastructure.

Level 4: Network/Host Artifacts (Annoying to change)

Patterns in network traffic or on the host that are characteristic of a tool or technique:

Cobalt Strike’s default Content-Type: application/octet-stream and jitter patterns in HTTP beaconing
A specific named pipe name (\\.\pipe\MSSE-1234-server)
Registry keys created by a specific persistence mechanism
Specific User-Agent strings from C2 frameworks

Evasion time: Days. The attacker must modify the tool’s configuration or source code.

Level 5: Tools (Hard to change)

Detecting that a specific tool was used — even if hashes or IPs change:

Mimikatz command output patterns (privilege::debug, sekurlsa::logonpasswords)
BloodHound LDAP query patterns (specific LDAP filters used during AD enumeration)
Impacket Python library signatures in network traffic

Evasion time: Weeks. Find or develop an alternative tool with the same capability.

Level 6: TTPs (Very hard to change)

Behavioral detections that match the technique, not the tool:

# Not: detect Mimikatz by hash
# Not: detect Mimikatz by command line
# But: detect any process accessing LSASS memory with PROCESS_VM_READ rights
detection:
  selection:
    EventID: 10
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains: '0x10'

This rule catches Mimikatz, ProcDump, and any future LSASS-dumping tool — even ones that don’t exist yet. The attacker must change the technique (use a different credential access method, or use kernel-mode access to bypass user-mode logging), which requires significant research and development.

Evasion time: Weeks to months. May require a fundamentally different attack approach.

Applying the Pyramid in Practice

When reviewing a new detection request:

Identify what the rule actually matches on
Map it to a Pyramid level
Ask: “Is there a higher-level version of this detection that’s still practical?”

Example: Request: “Add a hash-based rule for a malicious DLL from last week’s incident.”

Level 1 (Hash): Block the specific DLL hash. Done in 5 minutes. Will be evaded on next attack.
Level 4 (Artifact): What’s distinctive about how this DLL was loaded? Was it side-loaded from a user-writable directory? Use Sysmon Event 7 with ImageLoaded path in AppData AND Signed=false.
Level 6 (TTP): What technique does this DLL implement? If it’s DLL side-loading (T1574.002), write a behavioral detection for any unsigned DLL loaded from a user-writable path by a signed legitimate application.

Ship all three. The hash block protects you today. The behavioral detection protects you against the next variation.

Pyramid of Pain (David Bianco)— Detect-Respond Blog

Retrieval Practice

A threat intel feed delivers 5,000 new malicious IP addresses per day. Your team blocks them at the firewall automatically. What Pyramid level is this operating at, and what is the critical limitation?

Reveal answer

Level 2 (IP Addresses). Critical limitations: (1) Adversaries use infrastructure that rotates daily — a blocked IP is often already abandoned; (2) Sophisticated attackers use cloud providers (AWS, Azure), CDNs (Cloudflare), or legitimate SaaS platforms that can't be blocked without collateral damage; (3) Blocking IPs doesn't prevent an adversary who already has a foothold inside the network (east-west traffic doesn't go through the internet egress firewall). The value is for commodity threats with stable C2 infrastructure — not APT actors who expect IP-based blocking.

Retrieval Practice

You have a Sigma rule that detects Cobalt Strike by looking for its default named pipe 'MSSE-*-server'. An attacker modifies their Cobalt Strike profile to use a custom pipe name. What Pyramid level did your detection operate at, and what's the higher-level detection that would still catch them?

Reveal answer

Level 4 (Network/Host Artifact) — the named pipe name is a characteristic artifact of the default Cobalt Strike configuration. Higher-level detection: Level 5 (Tool) — Cobalt Strike's beacon communication uses specific HTTP patterns (beacon check-in timing, jitter calculation, specific URI formats) that persist even with custom malleable C2 profiles. Level 6 (TTP) — detect any process that creates a named pipe AND then receives shellcode via that pipe (process injection via named pipe is T1055 regardless of the specific pipe name). The TTP-level detection is: `Event 17 (Pipe Create) from non-system process` correlated with `Event 8 (CreateRemoteThread) from same process shortly after`.