A practical example is that defenders who block a malicious file hash force an attacker to change only the file, but defenders who detect the attacker’s infrastructure, tooling patterns and procedures make repeated operations much harder to sustain. In practice, analysts map detections to higher-impact indicators so they can disrupt adaptation, not just one sample.
How the Pyramid of Pain works in practice
A practical example is moving from a narrow block on one malicious file hash to detections that target the attacker’s infrastructure, tooling patterns, and procedural behaviour. The first approach forces only a quick sample change. The second forces repeated adaptation and often breaks the attacker’s ability to reuse the same tradecraft at scale.
The operational value comes from choosing indicators that are harder to replace. File hashes, domains, IPs, and other easily swapped artefacts sit lower on the pyramid. Tactics, techniques, and procedures sit higher, so they tend to create more friction for the adversary and more durable benefit for defenders.
What a higher-impact detection strategy looks like
A strong example is when analysts use telemetry to recognise the shape of the activity, not just one observable. That may include command patterns, parent-child process relationships, staging behaviour, beacon timing, or repeated operational workflows that identify a campaign even when the attacker rotates infrastructure.
This is why the pyramid of pain is useful as a prioritisation model, not just a visual. It helps teams decide where to invest effort: in signals that are cheap to replace, or in detections that expose the attacker’s method, which is much more expensive for them to rebuild.
When defenders map detections to patterns that survive simple substitution, they gain a better chance of disrupting campaign continuity. A single sample may disappear quickly, but the attacker’s preferred sequence of actions, dependencies, and infrastructure habits often persists long enough to be hunted and disrupted.
Why the example matters for threat detection programs
The practical lesson is that the best indicator is not always the easiest one to extract. Hashes and file names are fast to operationalise, but they usually produce short-lived gains. Infrastructure and behaviour-based detections take more analysis, yet they reduce the attacker’s ability to reuse an established playbook without paying a new cost each time.
That trade-off matters most when the same actor keeps returning with small variations. In that situation, the defender is trying to make the environment painful to reuse, not merely to catch one copy of one artifact. The Pyramid of Pain frames that decision clearly.
Risk and Threat Considerations
Low-level indicators are easy for attackers to change, so a defense that relies on them alone creates a false sense of coverage. Higher-level indicators are more durable because they force the adversary to alter infrastructure, tooling, or workflow, which is slower, noisier, and often more expensive.
Failure mechanism: If detection only keys off interchangeable artefacts, the adversary can keep operating by swapping samples, rotating hosts, or repackaging tooling while preserving the same campaign logic.
Impact: The organisation keeps seeing isolated alerts but fails to meaningfully slow the intrusion, which increases dwell time, repeat compromise risk, and analyst workload.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Tactics and Techniques — Adversary Tactics and Techniques | ATT&CK models the behaviors that pyramid-of-pain detections aim to expose. |
| Recommendation — Map detections to ATT&CK techniques and hunt for repeated behavioral patterns, not just file hashes. | ||
| NIST CSF 2.0 | DE.AE-01 — Anomalies and events are detected and analyzed | The example centers on detecting attacker behavior patterns rather than single artifacts. |
| Recommendation — Tune detection logic to identify behavioral anomalies and campaign patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Higher-level detections depend on telemetry that captures process, host, and network behavior. |
| Recommendation — Collect and review logs that preserve the behavioral evidence needed for pattern-based detection. | ||
Practitioner Guidance
What to prioritise: Build detections that identify recurring operational patterns, then use simple indicators as fast filters rather than the main defensive layer. That gives you quicker containment without depending on one fragile signal.
What to verify: Confirm that your detections still fire when the hash, domain, or IP changes but the underlying behaviour stays the same. If they do not, you are still defending the easiest layer for the attacker to replace.
Practitioner takeaway: The most useful Pyramid of Pain example is one where the defender shifts from blocking a sample to recognising the campaign’s repeatable method, because that is what turns one-off disruption into sustained pressure on the attacker.