Pyramid of Pain: The Six Levels of Indicators Explained

The Pyramid of Pain is a model that ranks the indicators a defender can detect, from file hashes up to adversary behaviour, by how much work it costs an attacker to change each one after it is blocked or detected. David J. Bianco published it on 1 March 2013 and added the hash level on 17 January 2014. This page explains the six levels, how to read the model, and how it relates to MITRE ATT&CK.

Who this is for: analysts, research-computing and security staff who handle threat intelligence and need to decide which detections are worth building first.

What the Pyramid of Pain is used for

It is used to judge the value of an indicator. Each level answers one question: if a defender denies the adversary this indicator, how hard is it for the adversary to carry on? Indicators at the base are precise but cheap for the attacker to replace; indicators near the apex cost the attacker real time and effort to replace. The model is conceptual, so there is nothing to install: it is applied by labelling the indicators in a feed, a report or a detection rule set with a level.

The six levels, from base to apex

Level	What it is	What the adversary must do when it is denied
1. Hash values	SHA1, MD5 or similar hashes of specific malicious or suspicious files	Change a single bit of the file; the hash changes. Trivial to evade.
2. IP addresses	An IP address or a netblock	Switch to another address. Little effort.
3. Domain names	A domain or subdomain	Register and host a new one. More effort than changing an IP address, but lax or free DNS providers keep the cost low.
4. Network and host artifacts	Observables caused by adversary activity on your network or hosts	Diagnose that they are being detected and modify their tools.
5. Tools	Software the adversary uses to accomplish the mission	Find or build a replacement and learn to use it, which takes significant time.
6. TTPs	Tactics, techniques and procedures: how the adversary goes about accomplishing the mission	Learn new behaviours. The most costly response for the adversary.

Source: David J. Bianco, "The Pyramid of Pain", Enterprise Detection & Response blog, read 2026-11-07.

How to read the pyramid

The pyramid combines two properties that pull in opposite directions. Low levels are easy to detect and match exactly but easy for the adversary to change. High levels are harder to build detections for, but when they work they force the adversary to change how they operate. The original post conveys pain by colour rather than by number: green for the lower three levels, yellow for network and host artifacts and tools, and red for TTPs. It does not assign numeric difficulty scores, so any score you attach is your own judgement, not part of the model.

Using it to prioritise detection work

This section is editorial interpretation of the model, not a rule stated in the source. A practical way to apply it:

1. List the indicators you currently receive or detect (for example from a threat report or an internal rule set).
2. Label each one with its level from the table above.
3. Count how many sit at levels 1 to 3. Those are quick to deploy but expire quickly, so plan to refresh them.
4. For every threat you care about, ask whether you have at least one detection at level 4, 5 or 6. If not, that is the gap the pyramid points to.

Lower-level indicators are not worthless. The source describes hashes as precise, and a block on a known indicator can still remove an easy path for the adversary; the model only says that denying them costs the adversary little. For a feed of file hashes, see the MalwareBazaar guide.

Relation to MITRE ATT&CK

The Pyramid of Pain does not appear on MITRE’s own resources page, so there is no official mapping. The two vocabularies overlap at the top of the pyramid. MITRE ATT&CK defines tactics as the reason for an action, techniques as how adversaries achieve a tactical goal, sub-techniques as more specific lower-level descriptions, and procedures as the specific implementation or in-the-wild use of a technique. That wording matches the pyramid’s TTP level, which is why defenders often use ATT&CK technique coverage as a way to measure work at the apex. Treat that mapping as an interpretation. Source: MITRE ATT&CK Resources, attack.mitre.org/resources, read 2026-11-07.

Limits of the model

• It ranks indicators by cost to the adversary, not by how likely they are to be seen or how damaging an incident is.
• The levels are coarse. Where a given artifact falls between levels 3 and 4, or between 4 and 5, is a judgement call.
• The source gives no quantified costs, so it cannot be used to calculate return on a specific detection.

For wider context on programme-level controls, see the cybersecurity overview and the NIST Cybersecurity Framework 2.0 guide.

Free alternatives and companions

Resource	What it provides
Bianco’s original post	The six-level model and its definitions, free to read
MITRE ATT&CK	A public vocabulary of tactics, techniques, sub-techniques and procedures

FAQ

What are the six levels of the Pyramid of Pain?

From base to apex: hash values, IP addresses, domain names, network and host artifacts, tools, and TTPs (tactics, techniques and procedures).

Who created the Pyramid of Pain?

David J. Bianco, in a blog post dated 1 March 2013. The hash level was added in an update on 17 January 2014.

Why is the top of the pyramid painful for attackers?

Because denying TTPs forces the adversary to learn new behaviours, which the source describes as the most costly response for them.

Is the Pyramid of Pain part of MITRE ATT&CK?

No. MITRE’s resources page does not mention it. ATT&CK’s technique and procedure definitions are a common companion for the TTP level.

Sources

• David J. Bianco, "The Pyramid of Pain", 2013-03-01 (updated 2014-01-17): detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html. Read 2026-11-07.
• MITRE ATT&CK, Resources: attack.mitre.org/resources. Read 2026-11-07.