What artifact would be considered at the top of the Pyramid of Pain and indicates a high level of sophistication in modifying behaviors to avoid detection?

The correct answer is C. TTPs. TTPs (Tactics, Techniques, and Procedures) sit at the apex of the Pyramid of Pain because they represent how an adversary thinks and operates - changing them requires significant effort, resources, and retraining, making detection at this level the most painful for attackers to…

Threat Hunting Fundamentals

Question

Options

AMD5 hashes
BIP addresses
CTTPs
DDomain names

How the community answered

(49 responses)

A
4% (2)
B
6% (3)
C
88% (43)
D
2% (1)

Explanation

TTPs (Tactics, Techniques, and Procedures) sit at the apex of the Pyramid of Pain because they represent how an adversary thinks and operates - changing them requires significant effort, resources, and retraining, making detection at this level the most painful for attackers to circumvent.

The distractors represent lower tiers of the pyramid where defenders cause minimal disruption:

MD5 hashes (A) are at the very bottom - trivial to change by recompiling malware with a single bit flip
IP addresses (B) are near the bottom - easily rotated using proxies, VPNs, or new infrastructure
Domain names (D) sit slightly higher but are still cheap to register and swap out quickly

Memory tip: Think of it as a pyramid of attacker effort to adapt. Hashes → IPs → Domains → Artifacts → Tools → TTPs. The higher you detect, the more you hurt them. "TTPs = The Truly Painful" because adversaries must fundamentally change their behavior, not just swap a file or IP.

Topics

#Pyramid of Pain#TTPs#Indicators of Compromise#Adversary Behavior

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice