Detection Engineering: The Pyramid of Pain

You blocked their hash. They changed one byte.

Here's a scene every SOC analyst knows. A threat intel feed flags a malicious file hash. You block it everywhere — firewall, EDR, email gateway — and feel good for about four minutes. Then the same malware shows up again with a different hash, because the attacker changed one byte in the file. One. Byte. Your block is now a museum piece.

This is the problem detection engineering exists to solve, and the cleanest way to think about it is a model from 2013 by SANS instructor David Bianco: the Pyramid of Pain. It's a ranking of the things you can detect about an attacker — ordered by how much it hurts them when you do.

The pyramid, bottom to top

Six levels. The bottom is easy for you and painless for them. The top is hard for you and miserable for them.

1. Hash values — trivial. A file's hash (MD5, SHA-256) is a fingerprint of that exact file. Change one byte — recompile, repack, toggle a setting — and the fingerprint is brand new. Attackers automate this. Detecting hashes costs them nothing.

2. IP addresses — easy. Block the server the malware talks to, and the attacker spins up a new one: a fresh cloud instance, a VPN exit node, a compromised website. Minutes of work, pennies of cost.

3. Domain names — simple. Slightly more friction — domains cost a few dollars and take a moment to register and propagate. Still cheap, still disposable. Attackers buy them in batches.

4. Network & host artifacts — annoying. Now it gets interesting. Artifacts are the fingerprints the attacker's tools leave behind: a distinctive User-Agent string, a specific URL pattern the malware always requests, a registry key it creates, the way its traffic is formatted. To evade detection here, the attacker has to go back into their tooling and change how it's built. That's real work.

5. Tools — challenging. Detect the tool itself — the custom backdoor, the specific credential dumper — and the attacker has to find or build a new one. Writing reliable malware takes time and testing. Burning a tool burns weeks of someone's life.

6. TTPs — tough. The top of the pyramid: tactics, techniques, and procedures — not what the attacker used, but how they behave. "They dump credentials from LSASS memory, move laterally over SMB, and stage data in a zip before exfiltrating." Detect the behavior and it doesn't matter what tool or hash or IP they swap in — you catch the play, not the jersey number. To evade you, they have to reinvent how they operate. Some never do.

Why this is the detection engineer's whole job

Most security programs live at the bottom of the pyramid without realizing it. Threat intel feeds — the subscriptions that pour thousands of hashes, IPs, and domains into your SIEM (Splunk, Microsoft Sentinel) — operate almost entirely at levels 1–3. That stuff is fine. It's hygiene. But hygiene is not a detection strategy, because everything at the bottom burns out in hours.

Detection engineering is the discipline of climbing. A detection engineer asks: what's the most durable way to catch this attacker? Then they write, test, and tune detections — in the SIEM, in the EDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) — aimed as high up the pyramid as they can manage:

• A Sigma rule that fires on a hash is level 1. The same rule rewritten to fire on the behavior — a process injecting into LSASS — is level 6.
• MITRE ATT&CK is the map for the top floors: it's a catalog of attacker behaviors (credential dumping is T1003, lateral movement over SMB is T1021.002), and good detection teams measure their coverage in ATT&CK techniques, not in feed volume.
• The firewall and DNS layer (Palo Alto, Infoblox) still earn their keep at levels 2–3 — blocking known-bad IPs and domains is cheap and automated — but nobody mistakes it for the main event.
• The SOAR (Cortex XSOAR, Splunk SOAR) automates the bottom of the pyramid — enriching and blocking indicators at machine speed — precisely so the humans can spend their hours on the top.

The honest caveats

Two, because this series doesn't do hype. First: you still need the bottom. Blocking a known-bad hash is nearly free, and it stops the lazy 95%. The pyramid doesn't say "never block hashes" — it says "know what a hash block is worth." Second: detection isn't blocking. Bianco's model is about detecting — the pain comes from the attacker knowing their behavior itself is burned, not just one disposable indicator. A block they route around in a minute teaches them nothing and costs them nothing.

The takeaway

Every detection you write sits somewhere on the pyramid, and its altitude is its lifespan. Hash: hours. IP: days. Behavior: as long as the attacker keeps being themselves. So when you evaluate a detection — or a vendor, or a feed — ask the pyramid question: when the attacker notices this, how much does it cost them to get around it? If the answer is "one byte," climb higher.