The library director wants the SOC to just block the hashes from a malware sample. Using the Pyramid of Pain, what should the analyst explain about durable detections?
Select an answer to reveal the explanation.
Short Explanation
A hash is a license plate the thief can swap in the parking lot. TTPs are how they drive — much harder to change. Pyramid of Pain puts hashes at the bottom and TTPs at the top, which is why ATT&CK-mapped detections outlast a block list.
Full Explanation
Using the Pyramid of Pain, the library director who wants to "just block the hashes" should hear that hashes are trivial for an attacker to change, while TTPs sit higher on the pyramid and are what ATT&CK-mapped detections aim at. Durable civic detections hurt adversaries who must change how they operate, not merely regenerate a file hash. Municipal SOCs that invest only in hash block lists keep winning overnight and losing next week.
Claiming hashes sit at the top of the pyramid so blocking them is the most durable control fails by concept: hashes are near the bottom and easy to burn. Claiming IP addresses are harder to change than TTPs so block lists beat ATT&CK-mapped detections fails by concept: infrastructure indicators are still easier to swap than behaviors and techniques. Treating the Pyramid of Pain as a Splunk dashboard that auto-blocks hashes fails by concept: it is an analytic model, not an ES app feature.
Exam caveat: Pyramid of Pain ranks indicator durability—hashes low, TTPs high—and exam answers prefer detections aligned to higher-pain behaviors.
Operational check: Keep hash threat lists for quick wins, but prioritize Engineer work on ATT&CK-annotated behavioral detections for library endpoints, and brief the director that hash-only blocking is perishable by design.