The threat hunting pyramid of pain is a concept that describes the progression of an adversary's actions in an attack, from initial access to the final goal of the attack. It is a way for security professionals to visualize and understand the different stages of an attack and how they can detect and respond to it.
The pyramid consists of five levels:
Initial access: This is the point at which an adversary gains access to a network or system. Examples of initial access include phishing attacks, exploitation of a vulnerability, or physical access to a device.
Execution: After gaining initial access, the adversary will execute their attack plan. This can include installing malware, running scripts or commands, or modifying system settings.
Persistence: In order to maintain a foothold in the system, the adversary will establish persistence. This can involve creating new user accounts, modifying system policies, or installing backdoors.
Privilege escalation: The adversary may then try to escalate their privileges in order to gain greater access to the system. This can involve exploiting vulnerabilities or using stolen credentials to access restricted areas.
Lateral movement: Finally, the adversary will attempt to move laterally within the system, gaining access to more resources and potentially reaching their final goal. This can include accessing other systems on the network, exfiltrating data, or sabotaging the system.
In threat hunting, security professionals will look for indicators of compromise at each level of the pyramid, starting with initial access and working their way up. For example, they might look for phishing emails or suspicious activity in system logs to identify initial access. They might then look for signs of malware execution or persistence, such as strange processes running or changes to system policies. By understanding the steps an adversary takes in an attack, security professionals can better detect and respond to threats.
