IOCs versus TTPs and the Pyramid of Pain
In short: IOCs are concrete artefacts such as file hashes, IP addresses and domains that show a compromise may have happened. TTPs describe how attackers behave. The Pyramid of Pain shows that detecting behaviour costs attackers far more to evade than blocking single indicators.
Indicators of compromise
An indicator of compromise (IOC) is a piece of evidence that suggests a system has been attacked. Common types are file hashes (for example SHA-256), IP addresses, domain names, URLs, email sender addresses, file names and registry keys. IOCs are attractive because they are precise and easy to load into firewalls, email gateways, EDR and SIEM searches.
Their weakness is that attackers can change most of them in seconds. Recompiling malware changes its hash; renting a new server changes the IP address. An IOC list from last month may catch nothing today, and old IP addresses may now belong to innocent services, causing false positives.
A related term is indicator of attack (IOA), used by some vendors for signs of an attack in progress, such as a process injecting into another, rather than leftovers afterwards.
Tactics, techniques and procedures
- Tactics: the attacker's goal at a stage, such as gaining initial access or moving laterally.
- Techniques: the general method used to reach that goal, such as phishing or dumping credentials.
- Procedures: the specific way a particular group carries out a technique, including their tools and command choices.
The MITRE ATT&CK framework catalogues these in a shared language. TTPs are harder to change because they reflect the attacker's skills, habits and tooling investment.
The Pyramid of Pain
Security researcher David Bianco proposed the Pyramid of Pain to show how much effort each kind of indicator forces an attacker to spend when defenders detect it. At the bottom, hash values are trivial to change. Moving up, IP addresses and domains cost a little more. Network and host artefacts, such as a distinctive user-agent string or a specific registry location, are annoying to alter. Tools take real effort to replace. At the top, TTPs require the attacker to learn new ways of working, which is expensive and slow.
Putting it into practice
| Level | Defensive example |
|---|---|
| Hash | Block a known ransomware binary hash in EDR |
| Domain | Sinkhole or block a phishing domain at DNS |
| Artefact | Alert on a scheduled task name used by a known toolkit |
| Tool | Detect a credential-dumping tool by its behaviour, not its file name |
| TTP | Alert whenever any process reads LSASS memory without a known reason |
Use both. IOCs give fast, low-cost protection during an active campaign and help scope incidents ("which hosts contacted this domain?"). TTP-based detections and threat hunts give durable protection. Give IOCs an expiry date, record their source and confidence, and review them regularly.
Tip: in an exam, if asked why behaviour-based detection is preferred, refer to the Pyramid of Pain and the cost to the attacker of changing behaviour.
Practice
Why are file hashes at the bottom of the Pyramid of Pain?
Give an example of a technique and a procedure for the same tactic.
Why should IOCs have an expiry date?
Key takeaways
- IOCs are specific artefacts; TTPs describe attacker behaviour.
- Most IOCs are cheap for attackers to change.
- The Pyramid of Pain ranks indicators by the cost to the attacker of evading detection.
- Use IOCs for quick blocking and scoping; use TTPs for durable detection.
- Record source, confidence and expiry for every IOC.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.