The library director wants the SOC to just block the hashes from a malware sample. Using the Pyramid of Pain, what should the analyst explain about durable detections?
Select an answer to reveal the explanation.
Short Explanation
A hash is a license plate the thief can swap in the parking lot. TTPs are how they drive — much harder to change. Pyramid of Pain puts hashes at the bottom and TTPs at the top, which is why ATT&CK-mapped detections outlast a block list.
Full Explanation
David Bianco's Pyramid of Pain ranks indicators by how much it costs the adversary to change them: hashes are cheapest, then IPs and domains, then host and network artifacts, then tools, then TTPs at the top. Blocking hashes is easy for the SOC and easy for the attacker to evade. ATT&CK-mapped detections target techniques and procedures, which is the durable layer the pyramid recommends. The pyramid is an analytic framework, not an Enterprise Security dashboard.