{"id":180,"date":"2025-10-24T17:11:58","date_gmt":"2025-10-24T17:11:58","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=180"},"modified":"2025-10-24T17:11:58","modified_gmt":"2025-10-24T17:11:58","slug":"pyramid-of-pain","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=180","title":{"rendered":"Pyramid of Pain"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/pyramidofpainax. Room created by: tryhackme, cmnatic, Dex01, 1337rce, str3g4tt4.<\/p>\n\n\n\n

I had THM Echo explain the concept of the Pyramid of Pain. “The Pyramid of Pain is a concept in threat intelligence that illustrates the relationship between different types of indicators of compromise (IOCs) and the difficulty attackers face when trying to change their tactics, techniques, and procedures (TTPs). At the base are easily changeable IOCs like file hashes, while at the top are more complex indicators like TTPs. The idea is that as you move up the pyramid, the pain (or cost) for adversaries increases, making it harder for them to adapt. This highlights the importance of focusing on higher-level indicators in threat detection and response.”<\/p>\n\n\n\n

In Task 2, Hash Values, THM breaks down what a hash is and quotes Microsoft with, “\u2026the hash value is a numeric value of a fixed length that uniquely identifies data. A hash value is the result of a hashing algorithm”. The room mentions VirusTotal. I highly recommend bookmarking that link, as I have used it numerous times in other THM rooms. In this task, THM wants you to analyze a PDF report based on the given hash of “b8ef959a9176aef07fdca8705254a163b50b49a17217a4ff0107487f59d4a35d”.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In Task 3, IP Address, THM covers the standpoint of IP addresses from the Blue Defense perspective and what to look out for. THM quotes the website Akami on Fast Flux, a “DNS technique used by botnets to hide phishing, web proxying, malware delivery, and malware communication activities behind compromised hosts acting as proxies. The purpose of using the Fast Flux network is to make the communication between malware and its command and control server (C&C) challenging to be discovered by security professionals”. If you wish to know more about Fast Flux, THM links to the Palto Alto link: https:\/\/unit42.paloaltonetworks.com\/fast-flux-101\/. To answer the next questions, THM wants us to review 2 additional reports with the given PID of 1632. You have to scroll a bit to find this information, but it was cool to see all the details of what comes with a report.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Up next with have Domain Names! The room explains what DNS is and why it’s vulnerable. This room suggests learning more from another room: https:\/\/tryhackme.com\/room\/dnsindetail, which I recommend for a better understanding of DNS. The room will have you go to a report on app.any.run. For the question “Provide the redirected website for the shortened URL using a preview: \u2026”, you will copy and paste the given link in a browser, and it will go to tryhackme.com. Side note: check out the website: tinyurl.com, where you can shorten any URL with the tinyurl handle.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 5, Host Artifacts, the goes attack patterns and\/or Indicators of Compromise. If you have detected the attack, the attacker will have to go back and change his tools and methods. In this room, we will go over a malicious file report to see what the attack has done to obtain our answers!<\/p>\n\n\n\n

regidle.exe makes a POST request to an IP address based in the US, on port 8080. What is the IP address?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The actor drops a malicious executable (EXE). What is the name of this executable?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The room points to a report from Virustotal. How many vendors determine this host to be malicious?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In Task 6, it goes over Network artficats. The wordage is not exhaustive but I suggest you re-read this a few times as Network artifcacts are extremly important within cybersecurity. With the next question, you are looking for the already taken screenshot and MSIE = Internet Explorer just FYI. Scroll up to the HTTP Post snippet to grab the next answer.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In Task 7, Tools, we as defenders have stopped the attckers and now they need to make a new “tool” to utilize. For example: “Well the phishing attempt failed, maybe I need try and crack their passwords instead”. THM goes onto to confirm that “Antivirus signatures, detection rules, and YARA rules can be great weapons for you to use against attackers at this stage”. They give out a few links to bookmark and the two questions that are asked in this room can be answered through the task as well as the website: https:\/\/ssdeep-project.github.io\/ssdeep\/index.html.<\/p>\n\n\n\n

To the final stage of the Pyramid of Pain! for Tactics, Techniques, and Procedures(TTPs). This includes the whole MITE ATT&CK MATRIX! https:\/\/attack.mitre.org\/. If you are unfamiliar with this, the direct quote from the website is: “MITRE ATT&CK\u00ae\u00a0is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base serves as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. With the creation of ATT&CK, MITRE is fulfilling its mission to solve problems for a safer world \u2014 by bringing communities together to develop more effective cybersecurity. ATT&CK is open and available to any person or organization for use at no charge.”<\/p>\n\n\n\n

The task wants us to navigate to the website to grab our answers.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When you are at the site, search for “Chimera” and then click on the top link to navigate to the Chimera threat group.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

For the Task 9 section, THM directs you to go into a static site. I implore you to go back to the rooms and skim the material or at least get an idea of the Pyramid. This was a fun room!<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/pyramidofpainax. Room created by: tryhackme, cmnatic, Dex01, 1337rce, str3g4tt4. I had THM Echo explain the concept of the Pyramid of Pain. “The Pyramid of Pain is a concept in threat intelligence that illustrates the relationship between different types of indicators of compromise (IOCs) and the difficulty attackers face when trying to change their tactics, techniques, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-180","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=180"}],"version-history":[{"count":7,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/180\/revisions"}],"predecessor-version":[{"id":199,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/180\/revisions\/199"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}