Pyramid of Pain

A model for the effort it takes an attacker to evade a given indicator that defenders use to detect whether a threat is present.

Indicators

From trivial to tough, i.e. increasing effort to evade for an attacker, the indicators are:

1. Hash values of known malicious files.
2. IP addresses that looks malicious or have malicious behaviour.
3. Domain names
4. Network artifacts
5. Host artifacts
6. Tools
7. Tactics, techniques, and procesudes (TTPs)

Sources

https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html