According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?

Question

Options

• ADomain names
• BTTPs
• CNetworM-lost artifacts
• DHash values

• A
  3% (1)
• C
  6% (2)
• D
  91% (32)

Explanation

Hash values (D) sit at the base of Bianco's Pyramid of Pain because an adversary can invalidate any hash-based detection by making a single trivial change to a file - recompiling, adding a byte, or repacking - making them nearly useless for sustained monitoring. TTPs (B) are wrong because they occupy the pyramid's apex; changing fundamental tactics, techniques, and procedures requires attackers to retrain and retool, causing maximum disruption. Domain names (A) are wrong because while attackers can rotate them, it costs time and infrastructure, placing them in the pyramid's middle tier. Network/host artifacts (C) are wrong because they reflect attacker behavior patterns embedded in tools and commands, making them moderately difficult to change without altering the attack methodology.

Memory tip: Think "Difficult for defenders, Delight for attackers" - Hash values give defenders the least leverage because they're the cheapest thing an attacker can change. The higher you go in the pyramid, the more it hurts the adversary to adapt.

No community discussion yet for this question.