Summiting the Pyramid — Analytic Robustness Scoring

The Pyramid of Pain tells you what type of indicator to target. Summiting the Pyramid gives you a rubric to measure how robust any specific detection is. These two frameworks work together: use Pyramid to choose your investment direction, use Summiting to grade what you build.

The Five Robustness Levels

CTID defines five levels for analytic robustness:

Level	Name	What it means
L0	Not Implemented	The analytic doesn’t fire (configuration error, data gap)
L1	Core to Sub-Technique	Detects a specific implementation variant; evaded by switching tools
L2	Core to Technique	Detects the technique broadly but misses edge cases
L3	Core to Tactic	Detects the goal regardless of technique variant
L4	Core to Tactic (adversary-agnostic)	Only evaded by abandoning the tactic entirely

Concrete Example: Credential Dumping (T1003)

L1 analytic (Sub-Technique specific):

# Detects: ProcDump by command line
detection:
  selection:
    CommandLine|contains|all:
      - 'procdump'
      - 'lsass'

Evasion: Use Mimikatz instead. Or rename procdump.exe. Or use a different LSASS dumping tool.

L2 analytic (Technique-level):

# Detects: any process with 'lsass' in command line
detection:
  selection:
    CommandLine|contains: 'lsass'

Evasion: Don’t reference lsass.exe by name in the command line (use its PID directly, or use an API call without shell arguments).

L3 analytic (Process Access behavior):

# Detects: any process opening LSASS with memory-read access rights
detection:
  selection:
    EventID: 10              # Sysmon Process Access
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains: '0x10'  # PROCESS_VM_READ

Evasion: Use kernel-mode access (requires a kernel driver exploit to bypass user-mode Sysmon interception).

L4 analytic (Kernel-level): An EDR using ETW Threat Intelligence provider hooks kernel-mode memory operations on LSASS regardless of which process requests them. This fires even on custom kernel drivers.

Evasion: You need a zero-day that bypasses kernel-level telemetry — orders of magnitude harder.

Scoring Your Rule Set

CTID’s process for applying Summiting to an existing rule set:

Step 1: For each technique, enumerate all known tool variants

For T1003.001 (LSASS Memory):

ProcDump (procdump.exe -ma lsass.exe)
Mimikatz (sekurlsa::logonpasswords)
CrackMapExec (—sam flag)
PowerSploit (Invoke-Mimikatz)
Comsvcs.dll (rundll32.exe comsvcs.dll MiniDump <pid> lsass.dmp full)
Task Manager (manually via Processes tab)
Windows Error Reporting (WerFault.exe creates LSASS minidumps)

Step 2: Test each rule against each variant

Rule	ProcDump	Mimikatz	Comsvcs.dll	Task Manager
CommandLine contains ‘procdump’	✓	✗	✗	✗
CommandLine contains ‘lsass’	✓	✗	✓	✗
Sysmon Event 10 (GrantedAccess 0x10)	✓	✓	✓	✓

Step 3: Assign Summiting level based on coverage

CommandLine contains 'procdump' → L1 (one tool variant)
CommandLine contains 'lsass' → L1-L2 (catches several but misses Mimikatz)
Sysmon Event 10 GrantedAccess → L3 (catches all user-mode LSASS access, regardless of tool)

Worked Example

Scoring a Sigma rule for encoded PowerShell

The rule:

detection:
  selection:
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
      - ' -e '

Tool variants for T1059.001 (PowerShell Execution):

powershell.exe -enc <base64> → ✓ (direct match)
powershell.exe -e <base64> → ✓ (direct match)
powershell.exe -noprofile -w hidden -e <base64> → ✓ (still matches -e )
Constrained Language Mode bypass via WDAC → ✗ (no command line flag involved)
PowerShell called via COM object (WScript.Shell.Run) → ✓ (if CommandLine is logged)
Obfuscation: -e^n^c (caret escaping in cmd.exe) → ✗ (doesn’t match -enc )
Shortened flag: -en → ✗ (not in the list)

Summiting score: L1 — catches the most common variant but evaded by 3 known methods.

Improvement path to L2: Add -en , -enco, and normalize carets before matching. Still misses COM-based invocation.

Improvement path to L3: Detect PowerShell’s encoded command execution via Script Block Logging (Event 4104) — ScriptBlockText contains decoded content regardless of how it was invoked. This catches all encoding variants.

Summiting the Pyramid (CTID)— CTID / MITRE Engenuity

Retrieval Practice

Your team has a Sigma rule that detects Cobalt Strike's default beacon via its User-Agent string 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)'. What Summiting level is this, and what would an L3 equivalent look like?

Reveal answer

L1 (Sub-Technique specific) — it detects Cobalt Strike's DEFAULT configuration. A trivial malleable C2 profile change replaces the User-Agent in minutes. The L3 equivalent targets the underlying behavior: (1) HTTP/S beaconing with regular timing + jitter to an external IP (timing analysis, not string matching); (2) Sysmon Event 17/18 (Named Pipe Create/Connect) for Cobalt Strike's inter-process communication between parent and beacon process; (3) Event 8 (CreateRemoteThread) from a non-system process injecting into a legitimate process like svchost.exe (the post-spawn injection step). These L3 detections fire regardless of which Cobalt Strike profile or which C2 framework is used.