Which of the following is included in the Pyramid of Pain?

The correct answer is A. Hash values. Hash values (A) are the foundation of David Bianco's Pyramid of Pain, representing the lowest tier of indicators of compromise (IoCs) - they are trivially easy for attackers to change (a single bit flip produces a new hash), making them the least "painful" for adversaries to…

Threat Hunting Fundamentals

Question

Options

AHash values
BUsernames
CEncryption algorithms
DFirewall rules

How the community answered

(46 responses)

A
89% (41)
B
2% (1)
C
2% (1)
D
7% (3)

Explanation

Hash values (A) are the foundation of David Bianco's Pyramid of Pain, representing the lowest tier of indicators of compromise (IoCs) - they are trivially easy for attackers to change (a single bit flip produces a new hash), making them the least "painful" for adversaries to evade.

Usernames (B) are not part of the Pyramid; they are identity artifacts used in access management, not a recognized IoC tier in the framework. Encryption algorithms (C) are cryptographic primitives, not threat intelligence indicators, and have no place in the Pyramid. Firewall rules (D) are defensive controls you configure, not observable attacker behaviors or artifacts - the Pyramid categorizes what attackers use, not what defenders deploy.

Memory tip: Think of the Pyramid from bottom to top as getting progressively harder to change - Hash values, IP addresses, Domain names, Network artifacts, Tools, TTPs. The acronym HID N T TTP ("hid 'n' TTP") can help you recall all six tiers, with hashes always anchoring the base.

Topics

#Pyramid of Pain#Threat Intelligence#Indicators of Compromise#Threat Hunting

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice