The Pyramid of Pain

One-line summary: Every indicator you detect costs the attacker something to replace. A hash costs seconds; a TTP costs months. Detect higher up the pyramid and you don't just block an attack, you break the attacker's way of working.

Created by David Bianco (2013).

0. The Pyramid at a Glance

              ▲        TTPs                     ⛔ Tough        "HOW they operate"
             ▲▲▲       Tools                    🔴 Challenging  "WHAT they operate with"
            ▲▲▲▲▲      Network/Host Artifacts   🟡 Annoying     "the FINGERPRINTS they leave"
           ▲▲▲▲▲▲▲     Domain Names             🟢 Simple       "their address (named)"
          ▲▲▲▲▲▲▲▲▲    IP Addresses             🟢 Easy         "their address (numbered)"
         ▲▲▲▲▲▲▲▲▲▲▲   Hash Values              🟢 Trivial      "one exact file"

The single question behind every level: How long would it take the attacker to replace this?

1. Hash Values 🟢 Trivial

What it is: a fixed-length value that uniquely identifies data, produced by a hashing algorithm. Same file = same hash.

The 3 algorithms to know

Memory hook: "32 · 40 · 64": count the characters to identify the algorithm instantly. 🔢 Bits: "128 · 160 · 256"

Not cryptographically secure = two different files can produce the same hash (a collision).

How analysts use hashes

• Identify and reference a specific malware sample or suspicious file.
• Ransomware/threat reports list IOC hashes at the end (e.g., The DFIR Report).
• Look them up:

Why it's at the bottom: one echo breaks it

Get-FileHash .\OpenVPN_2.5.1_I601_amd64.msi -Algorithm MD5
# D1A008E3A606F24590A02B853E955CF7

echo "AppendTheHash" >> .\OpenVPN_2.5.1_I601_amd64.msi

Get-FileHash .\OpenVPN_2.5.1_I601_amd64.msi -Algorithm MD5
# 9D52B46F5DE41B73418F8E0DACEC5E9F   ← completely different

Lesson: the file still works the same, but your hash blocklist is now useless. With endless variants of known malware, hunting by hash alone is a losing game.

2. IP Addresses 🟢 Easy

What it is: the address of any device on a network: desktops, servers, even CCTV cameras. As an IOC: the attacker's servers.

Defender's move: block, drop, or deny traffic from the IP at the perimeter/external firewall.

Why it's weak: an experienced attacker just switches to a new public IP. Not bulletproof.

Seeing malicious IPs: Any.run

A malware sample (some_malicious_file.bi..., PID 1632) connects over TCP 443 to IPs in the US and Germany (e.g., 50.87.136.52, 134.119.253.108). ⚠️ Never interact with IPs from a malware report.

Fast Flux 🌪️

Definition (Akamai): a DNS technique used by botnets to hide phishing, web proxying, malware delivery, and C2 communication behind compromised hosts acting as proxies.

Core idea: one domain name → many IP addresses that constantly change.

evil-c2.com ─► 1.2.3.4   (now)
            ─► 5.6.7.8   (5 min later)
            ─► 9.10.11.12 (5 min later)

Block one IP → the domain already points elsewhere. 🎯 That's why the domain is a better IOC here than the IP.

3. Domain Names 🟢 Simple (teal)

What it is: a text name mapped to an IP. Structure:

• evilcorp.com = domain + top-level domain (TLD)
• tryhackme.evilcorp.com = subdomain + domain + TLD

Why it hurts a bit more: the attacker must purchase, register, and configure DNS records. Why it still isn't hard: many DNS providers have loose standards and offer APIs that make changing domains easy.

Course example: Sodinokibi (REvil ransomware) campaign used dozens of C2 domains at once (e.g., boisehosting.net, koken-voor-baby.nl, olejack.ru). Notice one starts with xn--: that's Punycode (below).

🎭 Punycode attack (homograph)

Punycode: a way to convert words that can't be written in ASCII into an ASCII encoding.

Tell-tale sign: the xn-- prefix. Modern browsers (Chrome, Edge, Safari) are now good at displaying the real Punycode name.

Detect malicious domains with: proxy logs or web server logs.

🔗 URL shorteners

Attackers hide malicious domains behind short links: bit.ly, goo.gl, ow.ly, s.id, smarturl.it, tiny.pl, tinyurl.com, x.co.

Preview trick: append + to the short URL to see the real destination without visiting it:

http://tinyurl.com/cn6xznu+
http://bit.ly/vHIe3Si+

🧪 Any.run network tabs (from the sandbox)

4. Network & Host Artifacts 🟡 Annoying (yellow zone)

Why it's annoying: if you detect these, the attacker must go back and change their tools and methods: time-consuming and costs resources. It also buys you time to respond.

🖥️ Host artifacts

Traces left on the system: registry values, suspicious process execution, attack patterns/IOCs, files dropped by malicious apps, anything exclusive to the threat.

Course examples, decoded:

[Likely] Notice POwersheLL.exe with odd capitals: random casing is an old trick to dodge case-sensitive string matching. Detect the behavior, not the spelling.

🌐 Network artifacts

User-Agent strings, C2 information, URI patterns in HTTP POST requests.

User-Agent (defined in RFC 2616): the request header identifying the client making the request. An attacker may use one never seen before in your environment.

Detect with: PCAPs in Wireshark / TShark, or IDS alerts (e.g., Snort).

Example: Emotet

• Suspicious HTTP POST requests from 192.168.100.140 to many different external IPs, each with a long random-looking URI (/ghMuzyNCNWN/kMmYdVIthxeVy/...).
• Pull the User-Agents:

tshark -Y http.request -T fields -e http.host -e http.user_agent -r analysis_file.pcap

• Result: the same old UA over and over: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; ...) → Internet Explorer 7 on Windows 7 in a modern network = 🚩.
• Block/alert on that custom UA → more obstacles for the attacker.

Note: the course writes --Y; the correct TShark flag is -Y (display filter).

5. Tools 🔴 Challenging

Why it's game over (almost): detect the tool and the attacker must give up, or invest money to build a new one (if capable), find an equivalent, or train to use it.

Attacker tools include: maldocs (malicious macro docs for spearphishing), backdoors for C2, custom .EXE / .DLL files, payloads, password crackers.

Course example: a Trojan drops Stealer.exe in AppData\Local\Temp, then paylod.exe and Stealer.exe run under the user.

Defender's weapons

Regular hash vs fuzzy hash

VirusTotal Details tab shows many hashes for one file: MD5, SHA-1, SHA-256, Vhash, Authentihash, Imphash, Rich PE header hash, SSDEEP (format blocksize:hash:hash, e.g., 6144:Gz90qLc1zR98...), TLSH.

6. TTPs ⛔ Tough (the apex)

TTPs = Tactics, Techniques & Procedures: the whole MITRE ATT&CK Matrix, every step from phishing → persistence → data exfiltration.

Course example: detect a Pass-the-Hash attack via Windows Event Log monitoring and remediate it → find the compromised host fast and stop lateral movement.

The attacker's only two options:

1. Go back, research, train, reconfigure custom tools
2. Give up and find another target ← cheaper, so usually this one ✅

7. Where the Course Oversimplifies ⚠️ (advisor notes)

• [Certain] SHA-1 wasn't dropped because of "brute force." It was dropped because of practical collision attacks (Google's SHAttered, 2017, produced two different PDFs with the same SHA-1). Brute-forcing 160 bits is not feasible.
• [Likely] "Insecure" MD5 is still fine for malware lookups. Collisions matter for signatures and passwords, not for "is this file in VirusTotal." You'll see MD5 everywhere in SOC work. Just prefer SHA-256 in reports.
• [Likely] Hashes identify files, not actors. The course says hashes help "attribute payloads to an actor." Public malware is shared and sold; the same hash can appear in unrelated groups' attacks.
• [Likely] The + trick isn't universal. It works on services like bit.ly and TinyURL, but goo.gl was shut down by Google, and other shorteners differ. A safer habit: use an unshortening/URL-expander service or a sandbox.
• [Likely] User-Agents are easy to spoof. Blocking the Emotet UA works until the operator changes one config line. Combine UA with URI pattern + destination diversity + timing for a sturdier detection.
• [Likely] Detecting Pass-the-Hash is harder than the course implies. It relies on NTLM logon events (Event ID 4624, often logon type 3 or 9) plus context, and produces false positives. Expect correlation work, not a single magic event.
• [Likely] The pyramid isn't "ignore the bottom." Hashes, IPs, and domains are cheap, fast, and precise. Use them for immediate blocking, and invest in the top for detections that last.

⚡ 30-Second Recap

1. H-I-D-N-T-T ("Hackers Insist Doing Nasty Things Tirelessly"): pain rises as you climb.
2. Hashes: MD5 32 / SHA-1 40 / SHA-256 64 hex chars. One echo changes the hash.
3. IPs: block on the firewall, but Fast Flux = one domain, many rotating IPs.
4. Domains: Punycode (xn--), typosquatting, URL shorteners (append +).
5. Artifacts: host (registry, dropped files, odd process chains) + network (User-Agent, URI patterns, C2). Tools: TShark, Snort, Any.run.
6. Tools: YARA, AV signatures, SSDeep fuzzy hashing, MalwareBazaar, Malshare, SOC Prime.
7. TTPs: MITRE ATT&CK; detect behavior (e.g., Pass-the-Hash) and attackers retool or leave.

Cyber Kill Chain

Origin: military concept: identify target → decide & order attack → destroy target Cyber version: Lockheed Martin, 2011 Core idea: an attacker must complete every phase to succeed → break any one link and the attack fails

Used for:

• Understanding ransomware, breaches, APTs (Advanced Persistent Threats)
• Finding missing security controls and closing gaps
• Recognizing intrusion attempts + attacker goals (SOC, threat hunting, IR)

1. Reconnaissance        research the target
2. Weaponization         build the weapon
3. Delivery              send the weapon
4. Exploitation          weapon fires (code executes)
5. Installation          stay in (persistence)
6. Command & Control     remote control channel
7. Actions on Objectives achieve the goal

1. Reconnaissance

• Research & planning phase: infrastructure, employees, business processes, exposed tech
• Often passive and undetected
• Poor recon → sloppy attack; good recon → targeted, believable payloads

OSINT (Open-Source Intelligence) = info from public sources:

• Search engines
• Print & online media
• Social media
• Forums & blogs
• Public record databases
• WHOIS & technical data

Email harvesting = collecting email addresses from public, paid, or free services → used for phishing

2. Weaponization

• Turn recon into an attack tool: malware + exploit → payload
• Most attackers: automated generators or buy on the dark web
• APTs: write custom malware → unique sample, evades detection

Tactics:

• Office document with malicious macros / VBA (Visual Basic for Applications)
• Payload or worm on USB drives left in public
• Set up C2 infrastructure
• Backdoor to access the system & bypass security
• Tailored phishing templates or OAuth-consent apps that look legitimate

3. Delivery

Method of getting the payload to the target.

4. Exploitation

• Moment the attacker's code executes on the target

Techniques:

• Malicious macro execution (e.g., opening a phishing doc → ransomware)

• Zero-day exploit: unknown + unpatched flaw → no detection opportunity at first

• Known CVEs: unpatched public vulnerabilities

• After access → exploit further to escalate privileges or move laterally

Signs of exploitation:

• Unexpected process spawns
• Registry changes / new services
• Suspicious command-line arguments in logs

5. Installation

• Goal: persistent backdoor → regain access after disconnection, detection, or patching
• Backdoor = access point that bypasses security

Timestomping = modify file timestamps (modify, access, create, change) → evade forensics, look legitimate

6. Command & Control (C2)

• Malware opens a channel to the attacker's server → full remote control
• C2 beaconing = infected host regularly checks in with the C2 server
• C2 server can be the attacker's or another compromised host

7. Actions on Objectives

Hands-on-keyboard access → achieve the goal:

• Collect credentials
• Privilege escalation (e.g., workstation → domain admin via misconfiguration)
• Internal reconnaissance (find internal vulnerabilities)
• Lateral movement
• Collect & exfiltrate sensitive data
• Delete backups & shadow copies
• Overwrite / corrupt data

Shadow Copy (Volume Shadow Copy) = Windows technology for backups/snapshots of files or volumes, even while in use → deleted by ransomware to block recovery

Limitations

• Last updated 2011 → aging framework
• Built for perimeter + malware threats
• Modern attackers combine many TTPs; change hashes & IPs to defeat threat intel
• Can't identify insider threats (CISA: insider uses authorized access/knowledge to harm the organization)
• Use alongside MITRE ATT&CK and the Unified Kill Chain

Practice Mapping (Target breach, 2013)

Quiz Answers

⚠️ Advisor Notes

• [Certain] The course writes "ssc.exe"; the real tool is sc.exe
• [Certain] DNS = Domain Name System, not "Domain Name Server"
• [Likely] Real attacks aren't linear: phases repeat (recon again after access), and some get skipped (stolen credentials skip weaponization/exploitation entirely)
• [Likely] Weaponization happens on the attacker's side → defenders rarely see it; detection opportunities start at Delivery
• [Likely] Mapping PowerShell to Weaponization is debatable: in ATT&CK it's an Execution technique (T1059.001). Answer per the lab, but know the distinction
• [Likely] Target's real entry point was stolen credentials from an HVAC vendor (third-party access), then POS-malware on payment terminals; "spearphishing attachment" refers to that vendor being phished
• [Likely] The $18.5M multistate settlement was a record in 2017; larger ones have happened since (e.g., Equifax)
• [Likely] IRC C2 isn't dead: still seen in older/cheap botnets; modern C2 also abuses cloud services (Slack, Discord, Telegram, cloud storage)
• [Likely] Unified Kill Chain (Paul Pols, 2017) = 18 phases grouped into In → Through → Out; covers post-compromise movement the classic chain lacks
• [Likely] Shadow copy deletion (vssadmin delete shadows) is one of the strongest ransomware precursors → treat as near-certain malicious

Unified Kill Chain (UKC)

Author: Paul Pols, 2017 (updated 2022) Purpose: describe how attacks happen, from recon to objective, including the attacker's motive Relation to others: complements (doesn't compete with) Lockheed Martin's Cyber Kill Chain and MITRE ATT&CK Size: 18 phases, grouped into 3 cycles: In → Through → Out

IN       get a foothold          Recon → ... → C2 → Pivoting
THROUGH  spread inside           Pivoting → ... → Lateral Movement → Access
OUT      achieve the goal        Collection → Exfiltration → Impact → Objectives

1. Background Concepts

Kill chain

• Military term for the stages of an attack
• In cyber: the path attackers (hackers, APTs) use to approach and intrude a target
• Goal for defenders: understand it → pre-emptively protect or disrupt the attack

Cybersecurity posture = an organization's overall defensive strength

Threat modelling = steps to improve system security by identifying risk:

1. Identify systems/apps to secure and their function (critical? sensitive data?)
2. Assess their vulnerabilities and how they could be exploited
3. Create an action plan to secure them
4. Add policies to prevent recurrence (e.g., SDLC, phishing awareness training)

• Asset (IT) = a piece of software or hardware
• UKC supports threat modelling by showing attack surfaces and how systems can be exploited
• Threat modelling frameworks: STRIDE, DREAD, CVSS

2. Why UKC (Benefits)

3. All 18 Phases

4. Phase IN: Initial Foothold

Focus: gain access to a system or network; use recon to find attack vectors (apps, services); establish persistence. Attackers combine these tactics.

Reconnaissance (TA0043)

• Passive + active info gathering; used throughout later phases
• Finds: running systems/services, employee/contact lists (for phishing/impersonation), credentials, network topology

Weaponization (course: TA0001)

• Set up infrastructure: C2 server, system to catch reverse shells and deliver payloads

Social Engineering (TA0001)

• Get user to open a malicious attachment
• Fake web page to capture credentials
• Call/visit impersonating a user (password reset) or a worker (e.g., utility engineer) for physical access

Exploitation (TA0002)

• UKC definition: abuse of vulnerabilities to perform code execution
• Upload & execute a reverse shell on a web app
• Interfere with an automated script to run code
• Abuse a web app vulnerability to execute code on its host

Persistence (TA0003)

• Create a service for re-entry
• Register the system with a C2 server
• Backdoors triggered by actions (e.g., reverse shell when admin logs in)

Defense Evasion (TA0005)

• Evade: WAFs, network firewalls, antivirus, IDS
• Most valuable for defenders: shows how to improve defenses

Command & Control (TA0011)

• Uses infrastructure from Weaponization
• Execute commands, steal data/credentials, pivot to other systems

Pivoting (course: TA0008)

• Reach systems not otherwise accessible (not internet-exposed), often valuable or weaker
• e.g., public web server → internal systems on the same network

5. Phase THROUGH: Network Propagation

Trigger: foothold established, but objective not yet reached → gain more access/privileges. Compromised system becomes a base / pivot point to explore the internal network.

Pivoting (TA0008)

• Pivot system = staging site + tunnel between attacker and victim network + distribution point for malware/backdoors

Discovery (TA0007)

• Learn: active user accounts, permissions, software in use, browser activity, files/directories/shares, system configs

Privilege Escalation (TA0004)

• Use account info + vulnerabilities/misconfigurations to reach:
  • SYSTEM / root
  • Local Administrator
  • User with admin-like access
  • User with specific access/functions

Execution (TA0002)

• Deploy code via the pivot: remote trojans, C2 scripts, malicious links, scheduled tasks → recurring presence

Credential Access (TA0006)

• Works with privilege escalation
• Keylogging, credential dumping
• Legitimate credentials → harder to detect

Lateral Movement (TA0008)

• Use credentials + privileges to jump to target systems
• Stealthier = better (for the attacker)

6. Phase OUT: Action on Objectives

Focus: critical asset access → fulfil goals, usually against the CIA triad

7. MITRE Tactic IDs (as given in the course)

8. Quiz Answers

⚠️ Advisor Notes

• [Likely] In the 2022 UKC update, "Weaponization" became Resource Development, matching MITRE's TA0042. The course maps it to TA0001 (Initial Access), which is wrong for infrastructure setup
• [Likely] Pivoting has no ATT&CK tactic of its own. The course maps it to TA0008 (Lateral Movement); the tunneling part is closer to C2: Proxy (T1090)
• [Certain] Exploitation maps to TA0002 Execution in the course, but ATT&CK has no "Exploitation" tactic; it spreads across Initial Access (e.g., T1190 Exploit Public-Facing Application), Execution and Privilege Escalation
• [Likely] The "other frameworks are linear" claim is unfair to ATT&CK: it's a matrix, not an ordered chain, and is updated about twice a year. It fits Lockheed's kill chain much better
• [Certain] ATT&CK was created in 2013 but released publicly in 2015
• [Likely] Each cycle loops: Through repeats per new system until the target is reached; attackers often return to In (new phishing) if detected
• [Likely] Encrypted + compressed exfiltration hides content, not volume: big outbound transfers, unusual destinations and odd timing still stand out (exactly the quiz's traffic-spike scenario)
• [Likely] For SOC work, the cycle tells you urgency: an alert in In = contain early; Through = active intrusion, escalate; Out = data likely gone or impact underway, start IR immediately

MITRE: ATT&CK, CAR, D3FEND & More

MITRE = US not-for-profit doing R&D in cyber security, AI, healthcare, space systems Mission: "to solve problems for a safer world" Value: a common language for red and blue teams to understand adversaries, build detections, and harden defenses

1. MITRE ATT&CK

Definition: globally accessible knowledge base of adversary tactics and techniques based on real-world observations; foundation for threat models in private sector, government, and security vendors

• Started 2013: document TTPs used by APT groups
• Name = Adversarial Tactics, Techniques & Common Knowledge

Evolution

• Started Windows-only → now Enterprise matrix: Windows, macOS, Linux, cloud, network devices, containers, etc.
• Separate matrices: Mobile, ICS (Industrial Control Systems)
• Grows through community contributions
• Used by blue teams (defense) and red teams (realistic attack simulations)

The Matrix

• Tactics = columns across the top
• Techniques nested below each tactic
• Techniques expand into sub-techniques
• ATT&CK Navigator = tool to annotate, color, and explore matrices (layers)

Hierarchy example

Tactic:        Reconnaissance
Technique:     Active Scanning                T1595
Sub-technique: Scanning IP Blocks             T1595.001
               Vulnerability Scanning         T1595.002
               Wordlist Scanning              T1595.003

ID formats

Technique page contents

• Name + ID, sub-techniques
• Tactic, Platforms (e.g., PRE = pre-compromise), version, created / last modified dates
• Description
• Procedure examples: groups, software, campaigns
• Mitigations, Detections, References

2. Why ATT&CK Matters

• Standard terminology + unique IDs → same technique, one name → easy comparison of data and incidents
• Bridges threat intelligence → defense: a report says what happened; mapping to TTPs turns it into detection logic, queries, playbooks

Using ATT&CK for threat profiling (CTI workflow)

1. Identify your sector / environment (e.g., aviation, moving to cloud)
2. Groups section → find APTs targeting that sector
3. Open the group's Navigator layer → see its techniques
4. Read technique pages → mitigations + detection strategies
5. Compare against your controls → find gaps

CTI report → matrix: each attack stage maps to one technique ID, e.g. Recon T1595 → Initial Access T1190 → Persistence T1136 → Defense Evasion T1564 → Collection T1560

3. CAR (Cyber Analytics Repository)

• Knowledge base of ready-made detection analytics built on ATT&CK
• Each analytic: what behavior to look for + why (operating theory, rationale)
• Own data model used in pseudocode
• Implementations for real tools: Splunk, EQL, LogPoint
• Some include unit tests to validate the analytic
• Has its own Navigator layer + Analytics List
• Not every analytic has the same implementations

Analytic page fields

Example: Scheduled Task file creation

• Task Scheduler stores tasks as files in C:\Windows\System32\Tasks and C:\Windows\Tasks (legacy)
• Analytic: alert on new files in those folders (persistence, privilege escalation, remote execution)
• Splunk (Sysmon Event Code 11 = FileCreate):

  index=__your_sysmon_index__ EventCode=11 Image!="C:\\WINDOWS\\system32\\svchost.exe"
  (TargetFilename="C:\\Windows\\System32\\Tasks\\*" OR TargetFilename="C:\\Windows\\Tasks\\*")

4. D3FEND

• Detection, Denial, and Disruption Framework Empowering Network Defense
• "Knowledge graph of cybersecurity countermeasures"
• Common language for how security controls work
• ATT&CK = how attacks happen; D3FEND = how to stop them

7 tactics:

Technique page: definition, how it works, implementation considerations, digital artifact relationships, linked ATT&CK techniques

• IDs look like D3-XXX (e.g., D3-CRO Credential Rotation: regularly change passwords, API keys, certificates → stolen credentials expire)
• Artifact relationships use verbs: use-limits, regenerates, hardens

5. Other MITRE Projects

6. Quiz Answers

⚠️ Advisor Notes

• [Certain] ATT&CK was created in 2013 but released publicly in 2015
• [Likely] The CAR scheduled-task query excludes svchost.exe, but tasks created normally (via schtasks.exe or the API) are written to disk by the Task Scheduler service, which runs inside svchost.exe. So the analytic mainly catches task files dropped directly. That's why its coverage is rated Low; pair it with Event ID 4698 (scheduled task created) or Sysmon process events for schtasks.exe
• [Likely] Attribution in ATT&CK ("Mustang Panda is Chinese") is assessed by researchers, not proven; group names differ by vendor (Mustang Panda ≈ RedDelta, TA416, etc.)
• [Certain] Cobalt Strike is a commercial red-team tool that criminals and APTs use via cracked copies; seeing it doesn't identify a specific group
• [Likely] Detection strategies (DET####) are a recent ATT&CK addition (v18, late 2025) replacing older free-text detection sections; older guides won't mention them
• [Likely] Navigator heatmaps show what a group has been seen doing, not everything it can do. Absence of a technique ≠ the group won't use it
• [Likely] Mapping your detections to ATT&CK reveals coverage, not quality: a "covered" technique may still be bypassed (as the svchost exclusion shows). Validate with emulation (Caldera, Atomic Red Team)
• [Likely] For SOC work, the biggest everyday use is adding the technique ID to every alert report: it gives L2 instant context and lets the team spot which tactics keep firing