In the field of computer security and threat detection, an indicator of compromise (IOC) is a piece of evidence that some form of cyberattack has occurred, such as an intrusion or data breach. Just as detectives collect clues to trace backward from the crime scene, digital forensics experts search for IOCs to understand how the attack took place and who was responsible.

The Pyramid of Pain is a conceptual model for understanding cybersecurity threats that organizes IOCs into six different levels. Information security expert David J. Bianco was the first to formalize this idea in his article “The Pyramid of Pain” (Bianco, 2013).

The six levels of IOCs in the Pyramid of Pain are organized in order of how “painful” they would be to the attacker if the victim discovered them and took action against them. From the bottom to the top of the pyramid—from least painful to most painful—these IOCs are:

• Hash values: A hash value is a software or file “signature” that is the output of a complex cryptographic hash function such as SHA-1 and MD5. These hash functions practically guarantee that two different files will not have the same hash value.
• IP addresses: An Internet Protocol (IP) address is a set of numbers that uniquely identifies a computer or other device connected to the Internet.
• Domain names: A domain name is a string of text that uniquely identifies an Internet resource such as a website or server.
• Network artifacts/host artifacts: A network artifact is produced as the result of some network activity, while a host artifact is produced as the result of some activity on a host machine.
• Tools: Attackers use various software tools and platforms to carry out attacks (such as backdoors or password crackers).
• Tactics, techniques, and procedures (TTPs): Attackers often have a modus operandi that identifies them—everything from the initial method of entry to the means of spreading throughout the network and exfiltrating data.