bianco-pyramid-of-pain

name	bianco-pyramid-of-pain
description	Apply David Bianco's threat hunting frameworks including the Pyramid of Pain and Threat Hunting Maturity Model. Emphasizes prioritizing detection by adversary cost and building mature hunting programs. Use when designing detection strategies or assessing hunting capability.

David Bianco — Threat Hunting Frameworks

Overview

David Bianco is a SANS instructor with 20+ years in information security, primarily in detection and response. He created two foundational frameworks: the Pyramid of Pain (2013), which prioritizes indicators by adversary impact, and the Threat Hunting Maturity Model, which guides organizations in building hunting capability.

References

• Pyramid of Pain: Original 2013 blog post, SANS documentation
• Threat Hunting Maturity Model: SANS whitepaper
• Profile: https://www.sans.org/profiles/david-bianco

Core Philosophy

"The more pain you cause adversaries, the more effective your detection."

"Hunting is not about finding evil—it's about finding evil that your automated defenses missed."

Bianco's insight: not all indicators are equal. Detecting hash values is trivial for adversaries to evade; detecting their tactics, techniques, and procedures (TTPs) forces them to fundamentally change how they operate.

The Pyramid of Pain

                    /\
                   /  \
                  / TT \      ← TTPs: Tough! Adversary must change behavior
                 /  Ps  \
                /--------\
               /  Tools   \   ← Tools: Annoying. Must find/create new tools
              /------------\
             / Network/Host \  ← Artifacts: Irritating. Must reconfigure
            /   Artifacts    \
           /------------------\
          /   Domain Names     \ ← Domains: Simple. Register new ones
         /----------------------\
        /     IP Addresses       \ ← IPs: Easy. Change infrastructure
       /--------------------------\
      /       Hash Values          \ ← Hashes: Trivial. Recompile
     /------------------------------\

Level Details

Level	Indicator Type	Adversary Pain	Detection Value
1	Hash Values	Trivial	Low
2	IP Addresses	Easy	Low
3	Domain Names	Simple	Medium
4	Network/Host Artifacts	Annoying	Medium
5	Tools	Challenging	High
6	TTPs	Tough!	Highest

Threat Hunting Maturity Model

Level 0: Initial
├── Relies primarily on automated alerting
├── Little to no routine data collection
└── Hunting: None

Level 1: Minimal  
├── Incorporates threat intelligence indicators
├── Moderate data collection
└── Hunting: IOC searches only

Level 2: Procedural
├── Follows procedures from others
├── High/very high data collection
└── Hunting: Follows published playbooks

Level 3: Innovative
├── Creates new procedures
├── High/very high data collection
└── Hunting: Creates original hypotheses

Level 4: Leading
├── Automates successful hunts
├── Very high data collection
└── Hunting: Continuous, automated

When Implementing

Always

• Prioritize TTP-based detections over IOC matching
• Measure detection effectiveness by adversary pain
• Document and share successful hunt methodologies
• Automate proven hunts into continuous detection
• Assess your organization's hunting maturity honestly

Never

• Rely solely on hash-based detection
• Treat all indicators as equally valuable
• Hunt without a hypothesis
• Fail to document findings
• Ignore organizational maturity constraints

Prefer

• Behavioral detection over signature matching
• Hypothesis-driven hunts over random searching
• Automated continuous hunting over periodic campaigns
• TTP mapping over IOC collection
• Detection as code over manual rule creation

Implementation Patterns

Pyramid-Aware Detection Strategy

# detection_strategy.py
# Prioritize detections by Pyramid of Pain level

from dataclasses import dataclass
from enum import IntEnum
from typing import List, Optional

class PyramidLevel(IntEnum):
    """Pyramid of Pain levels - higher = more valuable"""
    HASH_VALUES = 1
    IP_ADDRESSES = 2
    DOMAIN_NAMES = 3
    ARTIFACTS = 4      # Network/Host artifacts
    TOOLS = 5
    TTPS = 6

@dataclass
class Detection:
    """A detection rule with pyramid classification"""
    name: str
    description: str
    level: PyramidLevel
    mitre_technique: Optional[str]
    query: str
    false_positive_rate: float
    
    @property
    def adversary_pain(self) -> str:
        pain_map = {
            PyramidLevel.HASH_VALUES: "Trivial - recompile",
            PyramidLevel.IP_ADDRESSES: "Easy - change infrastructure",
            PyramidLevel.DOMAIN_NAMES: "Simple - register new domains",
            PyramidLevel.ARTIFACTS: "Annoying - reconfigure tools",
            PyramidLevel.TOOLS: "Challenging - find/create new tools",
            PyramidLevel.TTPS: "Tough - must change tradecraft"
        }
        return pain_map[.level]
    

     () -> :
        
        
         (.level.value * ) * ( - .false_positive_rate)


 :
    
    
     ():
        .detections: [Detection] = []
    
     ():
        .detections.append(detection)
    
     () -> :
        
        coverage = {level: []  level  PyramidLevel}
         det  .detections:
            coverage[det.level].append(det.name)
         coverage
    
     () -> :
        
        coverage = .coverage_by_level()
        
        ttp_count = (coverage[PyramidLevel.TTPS])
        tool_count = (coverage[PyramidLevel.TOOLS])
        ioc_count = ((coverage[PyramidLevel.HASH_VALUES]) + 
                     (coverage[PyramidLevel.IP_ADDRESSES]) +
                     (coverage[PyramidLevel.DOMAIN_NAMES]))
        
        total = (.detections)
         total == :
             
        
        ttp_ratio = (ttp_count + tool_count) / total
        
         ttp_ratio > :
             
         ttp_ratio > :
             
        :
             
    
     () -> []:
        
        coverage = .coverage_by_level()
        recommendations = []
        
         (coverage[PyramidLevel.TTPS]) < :
            recommendations.append(
                
                
            )
        
         (coverage[PyramidLevel.TOOLS]) < :
            recommendations.append(
                
                
            )
        
        ioc_count = ((coverage[PyramidLevel.HASH_VALUES]) + 
                     (coverage[PyramidLevel.IP_ADDRESSES]))
         ioc_count > (.detections) * :
            recommendations.append(
                
                
            )
        
         recommendations



ttp_detection = Detection(
    name=,
    description=,
    level=PyramidLevel.TTPS,
    mitre_technique=,
    query=,
    false_positive_rate=
)


hash_detection = Detection(
    name=,
    description=,
    level=PyramidLevel.HASH_VALUES,
    mitre_technique=,
    query=,
    false_positive_rate=
)

Hunting Maturity Assessment

# maturity_model.py
# Assess and improve threat hunting maturity

from dataclasses import dataclass
from enum import IntEnum
from typing import List

class HuntingMaturityLevel(IntEnum):
    INITIAL = 0      # Relies on automated alerts
    MINIMAL = 1      # IOC searches
    PROCEDURAL = 2   # Follows playbooks
    INNOVATIVE = 3   # Creates new procedures
    LEADING = 4      # Automates hunts

@dataclass
class MaturityAssessment:
    """Evaluate hunting program maturity"""
    
    # Data Collection
    has_endpoint_telemetry: bool
    has_network_telemetry: bool
    has_cloud_telemetry: bool
    data_retention_days: int
    
    # Hunting Practice
    has_dedicated_hunters: bool
    hunts_per_month: int
    uses_threat_intel: bool
    documents_hunts: bool
    automates_successful_hunts: bool
    creates_original_hypotheses: bool
    
    # Infrastructure
    has_hunting_platform: bool
    has_playbook_library: bool
    measures_hunt_effectiveness: bool
    
    def calculate_level() -> HuntingMaturityLevel:
        
        
        
         (.automates_successful_hunts  
            .creates_original_hypotheses 
            .measures_hunt_effectiveness 
            .hunts_per_month >= ):
             HuntingMaturityLevel.LEADING
        
        
         (.creates_original_hypotheses 
            .documents_hunts 
            .hunts_per_month >= ):
             HuntingMaturityLevel.INNOVATIVE
        
        
         (.has_playbook_library 
            .has_dedicated_hunters 
            .hunts_per_month >= ):
             HuntingMaturityLevel.PROCEDURAL
        
        
         .uses_threat_intel:
             HuntingMaturityLevel.MINIMAL
        
        
         HuntingMaturityLevel.INITIAL
    
     () -> []:
        
        current = .calculate_level()
        
         current == HuntingMaturityLevel.INITIAL:
             [
                ,
                ,
                ,
                
            ]
        
         current == HuntingMaturityLevel.MINIMAL:
             [
                ,
                ,
                ,
                
            ]
        
         current == HuntingMaturityLevel.PROCEDURAL:
             [
                ,
                ,
                ,
                
            ]
        
         current == HuntingMaturityLevel.INNOVATIVE:
             [
                ,
                ,
                ,
                
            ]
        
         []

TTP-Based Hunt Design

# ttp_hunt.py
# Design hunts that target TTPs (maximum pain)

from dataclasses import dataclass
from typing import List, Dict

@dataclass
class TTPHunt:
    """A hunt targeting specific adversary TTPs"""
    
    name: str
    hypothesis: str
    mitre_tactic: str
    mitre_techniques: List[str]
    
    # Data requirements
    required_telemetry: List[str]
    
    # Hunt queries
    queries: Dict[str, str]  # platform -> query
    
    # Expected findings
    expected_benign: List[str]
    indicators_of_compromise: List[str]
    
    # Documentation
    references: List[str]
    
    def to_playbook(self) -> str:
        """Generate hunt playbook"""
        playbook = f"""
# Hunt Playbook: {self.name}

## Hypothesis
{self.hypothesis}

## MITRE ATT&CK Mapping
- **Tactic**: {self.mitre_tactic}
- **Techniques**: {', '.join(self.mitre_techniques)}

## Required Telemetry
{chr(10).join(f'- '  t  self.required_telemetry)}

## Hunt Queries

"""
         platform, query  .queries.items():
            playbook += 
        
        playbook += 
         playbook



credential_dump_hunt = TTPHunt(
    name=,
    hypothesis=,
    mitre_tactic=,
    mitre_techniques=[],
    required_telemetry=[
        ,
        ,
        
    ],
    queries={
        : ,
        : 
    },
    expected_benign=[
        ,
        ,
        
    ],
    indicators_of_compromise=[
        ,
        ,
        ,
        
    ],
    references=[
        ,
        
    ]
)

Mental Model

Bianco approaches threat hunting by asking:

1. What pyramid level is this? Prioritize TTP-based detection
2. What pain does this cause? Measure detection value by adversary impact
3. What's our maturity level? Match hunting to organizational capability
4. Can we automate this? Successful hunts become continuous detection
5. What did we learn? Every hunt improves the program

Signature Bianco Moves

• Pyramid of Pain for indicator prioritization
• Maturity model for program development
• TTP focus over IOC collection
• Hypothesis-driven hunting
• Automation of proven hunts
• Continuous improvement mindset