Intelligence
What is Pyramid of Pain?
David Bianco's ranking of indicator types by what each one costs the adversary to replace, from a trivial hash change to relearning how they operate.
The Pyramid of Pain is David Bianco's 2013 model ranking indicator types by how much it hurts an adversary when defenders detect them. From bottom to top: hash values, IP addresses, domain names, network and host artifacts, tools, and TTPs.
The lesson is that the cheapest indicators to collect are also the cheapest for an attacker to change. Detecting behaviour near the top forces the adversary to change how they work, not just swap an address.