Open cardosec

Case 464123 · Malware & intel · L1 Foundations

Pyramid of Pain

Practise as: Explain it
  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card
What a strong answer covers

Try it out loud first. Then check yourself:

  1. David Bianco model ranking indicators by how much pain denying them causes the attacker
  2. Bottom to top: hash values, IP addresses, domain names, network/host artifacts, tools, TTPs
  3. Hashes are trivial to change (one byte); blocking TTPs forces the adversary to relearn how they operate
  4. Guides CTI and detection investment toward the top of the pyramid
  5. Pairs naturally with ATT&CK, which catalogs the TTP layer

If the interviewer pushes back

  • Where do JA3 fingerprints or C2 malleable profile quirks sit on the pyramid, and why?

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.