Summiting the Pyramid of Pain

The talk starts from the Pyramid of Pain, which ranks indicators from easy-to-change hashes and IP addresses up to the tactics, techniques and procedures that are costly for adversaries to alter. The speakers note that ATT&CK documents techniques well, and that a recent campaign they studied used many techniques already catalogued. Even so, many public Sigma analytics tied to those techniques missed the campaign, because they depended on low-level fields such as executable file names that an attacker can simply rename.

To address this, the team proposes a scoring model with two dimensions: the logic of the behavior being matched, from ephemeral values up to invariant technique behaviors, and the event source, from user-mode to kernel-mode telemetry. A scheduled task example shows a Sysmon rule scoring low, then rising as fields change, moving to Windows event 4688, and finally monitoring the registry key the scheduler reads. Each step can trade precision for robustness, so the speakers suggest mixing robust and less robust analytics in a SOC.

The takeaway for practitioners is to check which observables an adversary can easily change, and to favor behaviors that cannot be avoided without a substantially different implementation. The team scored about 40 Sigma analytics, and Sigma has since added a pyramid score tag to its rules. They invite help scoring other platforms, event sources and EDR telemetry, and critiques of the method.