A threat intelligence team classifies IOCs using the Pyramid of Pain framework. Which level of indicator is most valuable and hardest for an attacker to change?
Select an answer to reveal the explanation.
Short Explanation
TTPs sit at the top of the Pyramid of Pain because changing an attacker's behavior, tools, and methods takes real effort. When you block TTPs, you disrupt operations instead of chasing cheap indicators.
Full Explanation
The tactics, techniques, and procedures (TTPs) option is correct because the Pyramid of Pain places TTPs at the top as the most impactful indicator level. Changing attack behavior, tools, and methodologies requires significant effort and expertise, so blocking TTPs truly disrupts attacker operations. Hash values (MD5/SHA-256 of malware files) are wrong because file hashes are at the bottom of the Pyramid of Pain and are trivially changed by recompiling the malware or making minor modifications. IP addresses used for C2 are wrong because IP addresses are easy to rotate with new VPS or bulletproof hosting, placing them low on the Pyramid of Pain. Domain names used for phishing are wrong because domain names are slightly harder than IPs to change due to registration requirements, but they are still relatively easy to swap and remain below TTPs on the Pyramid.