CompTIA CySA+ (CS0-003)Security OperationsMedium
A threat intelligence analyst tells the SOC team that blocking a malware file hash only causes an attacker a minor inconvenience, since a new hash can be generated instantly, whereas identifying and countering the adversary's tactics, techniques, and procedures (TTPs) forces them to fundamentally retool their entire operation. Which concept describes this hierarchy of indicator durability and value?
- AMITRE ATT&CK Matrix
- BCyber Kill Chain
- CDiamond Model of Intrusion Analysis
- DPyramid of Pain
Show answer & explanationAnswer & explanation
Correct answer: D. Pyramid of Pain
The Pyramid of Pain ranks indicators from easiest for an attacker to change (hash values, IP addresses at the bottom) to hardest to change (TTPs at the top). Detecting and defending against TTPs causes the most 'pain' to an adversary because it forces a fundamental change in behavior, not just a trivial artifact swap.
Why the other options are wrong
- A. ATT&CK catalogs TTPs but does not itself rank indicator pain levels.
- B. The Kill Chain describes attack stages, not indicator durability.
- C. The Diamond Model maps adversary, capability, infrastructure, and victim relationships, not indicator value.
Pyramid of Pain
A model ranking indicators of compromise by how much difficulty ('pain') it causes an adversary when defenders detect and block them.
- Bottom: hash values (trivial to change)
- Top: TTPs (very hard to change)
- Higher-level indicators provide more lasting defensive value
Memory trick: Hash is trash, TTPs cause real strife.