Module
IOCs & the Pyramid of Pain
Take a threat report full of indicators, rank each one by what it costs the attacker to replace, and decide which to block today, which to search history for, and which to hand to detection as behaviour.
64 min · Beginner
Start IOCs & the Pyramid of Pain
What you will learn
- Sort a report's items into atomic, computed and behavioural indicators, and say what a hit on each does and does not prove
- Place every item in a threat report on the six levels of the Pyramid of Pain
- Say how long a block on a hash, an IP or a domain keeps working and what else it might break
- Find a rebuilt sample by searching for the network or host artifact its new hash does not change
- Turn a report into a plan: block with an expiry, search history, and hand the behaviour to detection
Lessons
What Counts as an Indicator
An indicator is any piece of information that describes an intrusion. Hashes, IPs and domains are six of the ten items in the report, and the least interesting six.
Six Levels of Pain
The most certain indicator is the cheapest one for the attacker to throw away. The Pyramid of Pain ranks indicators by what they cost the attacker, not by how sure you are.
Hashes, IPs and Domains
Five searches come back empty and one comes back with 410 hosts. What a block on the bottom of the pyramid buys, how long it lasts, and what it can take down with it.
Artifacts and Tools
A new hash rarely means a new piece of malware. Climb to the middle of the pyramid, search for what the attacker forgot to change, and find the laptops the hashes missed.
The Whole Pyramid
Only the top matters, so skip the hashes? No. Turn the report into a plan that gives every level a job: block with an expiry, search history, and hand the behaviour to detection.