Artifacts at which level of the Pyramid of Pain provide the most context about an attack but are also the most challenging to use for attribution?

Question

Options

• AIP addresses
• BDomain names
• CFile hashes
• DTTPs

• A
  13% (3)
• B
  4% (1)
• C
  4% (1)
• D
  78% (18)

Explanation

TTPs (Tactics, Techniques, and Procedures) sit at the apex of the Pyramid of Pain, meaning they reveal the most about how an attacker thinks, moves, and operates - painting a full behavioral picture of the intrusion. Despite this richness, they are the hardest to use for attribution because TTPs can be shared, borrowed, or deliberately mimicked across threat groups, making it difficult to pin an attack to a specific actor with confidence. File hashes (C) sit at the pyramid's base - trivially easy for attackers to change but also the easiest for defenders to use for attribution since each hash is highly specific. IP addresses (A) and domain names (B) fall in the middle - they offer moderate specificity but are cheap for attackers to rotate, and they provide limited behavioral context about the attack itself.

Memory tip: Think of the pyramid as a tradeoff - the higher you go, the richer the context but the harder to pin on a specific actor. TTPs = "Top of the pyramid, Top context, Tough attribution."

No community discussion yet for this question.