300-220 · Question #94
Which level of the Pyramid of Pain is most difficult for attackers to change and adapt to when detected?
The correct answer is D. TTPs (Tactics, Techniques, and Procedures). TTPs sit at the apex of the Pyramid of Pain because they represent how attackers think and operate - their methodologies, behavioral patterns, and tooling strategies. When defenders detect and respond to TTPs, attackers must fundamentally retrain, restructure their operations…
Question
Which level of the Pyramid of Pain is most difficult for attackers to change and adapt to when detected?
Options
- AHash values
- BIP addresses
- CDomain names
- DTTPs (Tactics, Techniques, and Procedures)
How the community answered
(32 responses)- A9% (3)
- B3% (1)
- C3% (1)
- D84% (27)
Explanation
TTPs sit at the apex of the Pyramid of Pain because they represent how attackers think and operate - their methodologies, behavioral patterns, and tooling strategies. When defenders detect and respond to TTPs, attackers must fundamentally retrain, restructure their operations, and rebuild their playbooks, which is enormously costly and time-consuming.
Why the distractors are wrong:
- A. Hash values - At the base of the pyramid; trivially easy to change by recompiling malware or flipping a single bit.
- B. IP addresses - Low-mid tier; attackers rotate IPs constantly using proxies, VPNs, or botnets with minimal effort.
- C. Domain names - Mid-tier; annoying for attackers to change (requires re-registration, DNS setup) but still cheap and fast.
Memory tip: Think of the pyramid like an actual pyramid - the higher you go, the harder it is to climb (for attackers). TTPs are the peak because they're baked into how threat actors think and behave, not just the artifacts they leave behind. The acronym "TTPs = The Toughest Problem" can help lock this in.
Topics
Community Discussion
No community discussion yet for this question.