A threat intelligence team classifies IOCs using the Pyramid of Pain framework. Which level of indicator is most valuable and hardest for an attacker to change?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because the Pyramid of Pain places TTPs at the top (most impactful) because changing attack behavior, tools, and methodologies requires significant effort and expertise; blocking TTPs truly disrupts attacker operations. A is wrong because file hashes are at the bottom of the Pyramid of Pain — trivially changed by recompiling the malware or minor modification.
Full explanation below image
Full Explanation
C is correct because the Pyramid of Pain places TTPs at the top (most impactful) because changing attack behavior, tools, and methodologies requires significant effort and expertise; blocking TTPs truly disrupts attacker operations. A is wrong because file hashes are at the bottom of the Pyramid of Pain — trivially changed by recompiling the malware or minor modification. B is wrong because IP addresses are easy to rotate (new VPS, bulletproof hosting); they are low on the Pyramid of Pain. D is wrong because domain names are slightly harder than IPs to change (require registration) but still relatively easy to swap, placing them below TTPs on the Pyramid.