In-Depth
Pyramid of Pain and AI
There's a 13-year-old diagram and article that's fundamental to modern cybersecurity defense: the Pyramid of Pain. It has been changing drastically recently, and the consequences will affect your organization's ability to defend itself.
In this article, I'll bring David Bianco's insight into the AI age, consider the acceleration brought about by AI and explain why paying attention to these fundamentals puts you in a better strategic position for defense than chasing the latest AI cybersecurity news.
I'll also look at the modern endpoint protection landscape and why the riskiest app on your device is probably the least well monitored, plus cover three attacks that have become popular recently.
The Basics
IT is a young field, and cybersecurity is younger still, and we're still finding our feet in a rapidly changing landscape -- so I always look for smart people to explain the fundamental building blocks to build my understanding on. Once I have that, the new flavor-of-the-day attack slots into the right place in my strategy for defending my clients, rather than upending the whole plan.
The pyramid of pain is a way to describe the ways that defenders can detect and stop attacks in their environment.
[Click on image for larger view.] Pyramid of Pain (courtesy of David J. Bianco).
The "pain" here is the difficulty attackers experience when you block each layer of the pyramid. At the bottom we have hashes of suspicious or malicious files. This is the traditional "fingerprinting" of bad files -- if you see this file (it has to be exactly the same), it's bad -- block it. If the attacker makes a small change to the file, the hash will be different, so this inflicts very little pain on the attacker. IP addresses are again a way to block an attack from a single address or perhaps a netblock, but again, it's trivial for an attacker to shift to another address. Domain names take a little more work to recreate; hence, they are slightly higher in the pyramid.
When we get to network and host artifacts, things start to become more interesting from a defender's point of view -- if I can identify characteristics of your network traffic that I can build detections around, you'll have more work to change your approach so your traffic no longer matches. The same applies to any tools or malware you run on the endpoint. The penultimate layer is tools, and when an attacker brings their own tools onto hosts and I've got the ability to find and block those tools, there's definitely more work for the attacker to update and change them.
The pinnacle is Tactics, Techniques and Procedures (TTPs), the unique "behavior" of attacks. If you can detect and block those, it's tough for the attacker to change them, as doing so requires a fundamental change to their playbook.
The pyramid was created in 2013, based on the original APT-1 report by Mandiant, which was the first "outing" of a state-sponsored (Chinese in this case) espionage group and their ongoing campaign against 141 victim organizations. But cybersecurity has changed dramatically in the last 13 years (Microsoft, for example, now tracks over 1,500 unique threat groups), particularly recently with AI being adopted by the attacker ecosystem.
AI and the Pyramid of Pain Today
The main impact of the AI adoption by attackers is to compress timelines, meaning they can make changes to their tools, generate new infrastructure and adopt new techniques very quickly. Even before AI, the case against indicator-based detections was strong, but now it's a slam dunk -- the bottom of the pyramid is breaking down. Using hash values, IP addresses and domain names as malicious indicators is too slow. Any method that involves analysts identifying "badness," then labeling and marking these artifacts, is outdated before it becomes useful.
Incidentally, this is why Microsoft created TITAN -- its system in which machine learning automatically identifies malicious indicators and pushes them out to all Defender XDR systems.
Using AI vibe coding, attackers can trivially change fake sign-in pages, scripts and domains automatically, so, in effect, almost every attack is new from a defender's point of view.
Intuitively, I think we all understand this. It's the same reason that 20 years ago you would install an antivirus tool with a signature database of known viruses that would be updated daily and eventually hourly. Today we know that this isn't enough. No AV vendor can produce signatures for every malicious file (there are approximately 560,000 new ones created every day) fast enough. Hence, we use Endpoint Detection and Response (EDR), which looks at behavior of files to determine if they're malicious or not. The insight here is that this isn't related only to malware; it applies to nearly every other artifact type in the pyramid.
For us defenders, this means that while we can still use detections based on the lower parts of the pyramid, we need to focus most of our efforts on developing detections for techniques and behaviors that are durable, even when all other indicators change. And if we rely on vendors to supply detections in our XDR or cloud protection tools, we need them to adopt this approach.
Requirements for Detecting Behavior
To start with, you need the right vantage point to see the behavior -- if you want to see attacks in your IaaS deployments, for example, you need EDR agents deployed in your VMs, but you also need to connect logging from your cloud provider into a SIEM or similar solution because threat actors can also attack the infrastructure around your VMs.
To spot malicious activity around your human, nonhuman, workload and agentic identities, you need the logs from your identity provider (IdP). Network monitoring and detection can be useful, but there are limitations today because most traffic (even internal) is encrypted by TLS; thus, only metadata is available.
EDR will collect the logs from your endpoints, but they're mostly blind to the most common application in businesses today -- the web browser. Many attacks target identity and SaaS apps, and these don't download a malicious file on the endpoint, nor do they generate malicious network traffic, and so the entire attack looks like a benign web session for a tool such as EDR outside the browser. This is why I think enterprise browsers and/or the Push Security add-in and its competitors are so important for visibility in the modern IT world.
Second, you need to be able to detect new attack techniques and turn them into detections quickly, something that requires skilled analysts working alongside integrated AI tools.
Three 'Popular' Attacks
Let's start with ClickFix, which was popularized last year and is now increasingly common in many variants. It starts with a phishing email, malicious ad (very popular!) or a compromised website that pops up a CAPTCHA-looking prompt for you to prove that "you're human." It generally involves copying some innocent-looking text and then pasting it into the Run command on Windows (variants also exist for macOS and mobile devices) -- in effect tricking the user into running the malicious command on behalf of the attacker through social engineering.
ClickFix Example Instructions (courtesy of Microsoft).
A newer attack type is ConsentFix, which attacks the authorization layer rather than the authentication layer, rendering even strong, phishing-resistant authentication like 2FA hardware keys or phone-based passkeys useless. The attack works like this -- the victim is directed to a page (using any of the methods that ClickFix uses) that asks them to paste in a URL and provides a button that redirects them to the legitimate sign-in page for Microsoft 365 (or any other OAuth-based IdP), where they sign in or, if they're already signed in, simply confirm their identity. Once signed in, the URL contains an OAuth authorization code that the user copies and pastes into the original page -- giving the attacker access to an application (as the user) such as Azure CLI (command-line interface). Newer versions do away with asking the user to copy and paste the URL, instead providing a pop-up that the user can simply drag and drop onto a field on the original page.
[Click on image for larger view.] ConsentFix Flow (courtesy of Push Security).
Finally, there's device code phishing, which uses a legitimate Entra flow designed to help users sign in to input-restricted devices (smart TVs, printers, etc.). The login process starts on the device but is completed on a computer, generating a code that can then be typed into the device. This can be blocked with a Conditional Access policy in Entra, but be aware that some legitimate flows might break and need to be excluded from the policy.
Users aren't trained to be suspicious of these attack types, which helps explain their rising success rate.
Conclusion
As AI is adopted by attackers more broadly, the main effect we're seeing is compression of timelines. Whether it's the time from public disclosure of a software vulnerability to the appearance of attack code shrinking from months to hours (see the zero-day clock), forcing faster patching and hardening, or the constant churn of domains, IP addresses and tool variants, defenders must keep up with the new threat landscape. Focusing on detecting techniques and behaviors is the most durable approach -- happy hunting!