Lab 9 of 17 · By Michael Stout
In this lab
Read the steps, then try them in your lab environment.
Profile a threat actor, then rank what you found
Chapter 4 splits threat classification into actors, TTPs, and mapping. This lab uses two free, no-install resources — the MITRE ATT&CK groups catalog and the Pyramid of Pain — to turn a threat group's profile into a ranked list of what's actually worth detecting.
Not every indicator is worth the same effort
A file hash is trivial for an attacker to change — recompile and it's different. A tactic, technique, or procedure is expensive to change — it often means retraining people or rebuilding tooling. David Bianco's Pyramid of Pain ranks indicator types by exactly that cost. MITRE ATT&CK's group profiles give you real TTPs to rank, instead of made-up ones.
Hash values → IP addresses → domain names → host/network artifacts → tools → TTPs. The higher you detect, the more it costs the attacker to route around you.
What you'll need
Nothing to install — a browser and both sites: attack.mitre.org/groups and sans.org/tools/the-pyramid-of-pain.
Pen and paper, or a blank document to record what you find.
25–35 minutes.
Pick one, and read the whole page
- Browse the list. Go to
attack.mitre.org/groups— over 180 tracked groups, each an “activity cluster” the security community follows under a common name. - Open one that interests you. Any group works for this exercise. Record: its known aliases, three to five techniques it's reported using (with their ATT&CK technique IDs), and any named software or malware associated with it.
- Note the sourcing. Each technique links to the public report it came from. Threat intel is only as good as its sourcing — check at least one link.
Sort your notes onto the pyramid
- Open the Pyramid of Pain. Go to
sans.org/tools/the-pyramid-of-painand note the six levels from bottom (trivial to change) to top (tough to change). - Sort your group's indicators. A named piece of malware or software is a tool. A described behavior — “uses scheduled tasks for persistence,” “relies on living-off-the-land binaries” — is a TTP, the top of the pyramid.
- Answer the real question. If you could only build one detection for this group, would you write it against a tool, or against the technique? Which one survives the group changing its toolkit next month?
Group names, aliases, and “who's behind this” attribution are analyst judgment calls, not certainties — different vendors sometimes name the same activity differently, or disagree on attribution entirely. Chapter 4's own material on confidence levels applies directly here.
Sources. MITRE ATT&CK, Groups, attack.mitre.org/groups. SANS Institute, The Pyramid of Pain (David Bianco), sans.org/tools/the-pyramid-of-pain.