The Pyramid of Pain illustrates the increasing operational difficulty imposed on an adversary when defenders successfully detect and deny progressively more behavioral indicators. At the lower levels are artifacts that attackers can replace relatively easily, such as hash values and IP addresses. Higher levels include domain names, network or host artifacts, tools, and ultimately tactics, techniques, and procedures (TTPs) .

Its central defensive lesson is that not all indicators impose equal cost on an attacker. Blocking one IP address may require the attacker only to obtain another server. Detecting a specific malware hash can often be defeated by recompiling or modifying the file. Detecting the attacker's established behaviors and operational methods creates substantially greater difficulty because the adversary may need to redesign procedures, change tooling, retrain operators, or alter an established intrusion methodology.

The Pyramid of Pain was developed specifically to describe this relationship between indicators and the amount of operational “pain” defenders impose when those indicators are denied.

Option B describes impact measurement, not indicator durability. Option C concerns intelligence-source classification. Option D resembles threat-modeling approaches such as STRIDE rather than the Pyramid of Pain.

Study Guide Reference: Security Operations → Threat Intelligence → Pyramid of Pain → Indicators of Compromise → Tools → TTPs → Behavioral Detection.