IOCs and TTPs

Two threat reports land on the same actor. The first is a wall of 300 file hashes and 80 IPs. The second is four paragraphs describing how the group phishes, what they run for persistence, and how they move laterally, each tied to an ATT&CK ID. Six weeks from now the first report is dead, because the attacker recompiled and rehosted. The second still works, because the group still has to do the same things to reach the same goals. As a CTI producer, your job is to write more of the second kind.

David Bianco's Pyramid of Pain is the model that explains why. It ranks indicator types by how much it hurts the adversary when you take that indicator away from them.

The pyramid, bottom to top

At the base sit hash values. Trivial. One recompile, one changed byte, and every hash you catalogued is worthless. IP addresses come next, easy, a new cloud instance costs pennies. Domain names are a small step up, a registration and some setup time. All three are cheap for the attacker to rotate, which means low value for you to hunt on.

Higher up you find network and host artifacts: a specific user-agent string, a named mutex, a registry key the malware always writes, a distinctive C2 URI pattern. Now the attacker has to change their tooling, which is annoying but doable. Above that sit tools, the actual malware family or off-the-shelf kit. Take away their tool and they have to find or build another one.

At the peak: TTPs. Tactics, techniques, and procedures. Not what they touched, but how they operate. Dumping credentials from LSASS. Using WMI for lateral movement. Persisting through a scheduled task that calls back on a jitter. Force an attacker to abandon a technique and you have made them retrain and rebuild, not just re-register. Bianco's label for that top tier is "tough," and that is the pain worth inflicting.

Write the report so it ages well

IOCs still belong in the report. They are the cheap, fast, machine-matchable first pass, and blocking a known-bad hash costs you nothing. The mistake is stopping there. A report that is all indicators hands the reader a tripwire that the attacker steps over the next morning.

Map the behavior to ATT&CK so the reader can build a durable detection. "The actor uses rundll32.exe to proxy execution of a malicious DLL" becomes T1218.011, and now the reader can hunt the technique class, not one filename.

The Diamond Model keeps a finding organized

For each intrusion, the Diamond Model gives you four corners to fill: adversary, capability, infrastructure, and victim. The capability and infrastructure corners are your IOCs and tooling. The adversary corner is attribution and intent. The victim corner is who and why. Filling all four forces you to state what you actually know versus what you are guessing, and it makes two separate reports comparable when you pivot between them later.