Verified:GitHub

bianco-pyramid-of-pain

Apply the Pyramid of Pain and Threat Hunting Maturity Model to prioritize detection strategies.

Updated Jan 24, 2026

Search Tags:#threat hunting #security operations #mitre att&ck #detection engineering #pyramid of pain #adversary emulation

Ready to run

npx skills add https://github.com/copyleftdev/sk1llz --skill bianco-pyramid-of-pain

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bianco-pyramid-of-pain
Source: https://github.com/copyleftdev/sk1llz/tree/main/domains/security/threat-hunting/bianco
Command: npx skills add https://github.com/copyleftdev/sk1llz --skill bianco-pyramid-of-pain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires PyYAML, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security teams prioritize their detection and hunting efforts by focusing on indicators that cause the most "pain" for adversaries, making their operations more costly and difficult.

Core Features & Use Cases

Pyramid of Pain Framework: Understand and apply David Bianco's model, ranking indicators from low-value hashes to high-value TTPs.
Threat Hunting Maturity Model: Assess and improve your organization's threat hunting capabilities.
Detection Strategy Guidance: Implement patterns for building effective, adversary-centric detection rules and hunt hypotheses.
Use Case: A security analyst can use this Skill to evaluate their current detection rules, identify gaps in TTP coverage, and plan hunts that target the most impactful adversary behaviors.

Quick Start

Use the bianco-pyramid-of-pain skill to assess the maturity of a threat hunting program based on provided characteristics.

Frequently Asked Questions about bianco-pyramid-of-pain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is the Pyramid of Pain in threat hunting and detection engineering?▼

The Pyramid of Pain is a threat hunting framework ranking indicators from low-value hashes to high-value TTPs. It helps prioritize detection strategies by focusing on adversary behaviors that cause the most operational cost when blocked.

How do I assess my threat hunting program maturity?▼

Assess threat hunting maturity using the Threat Hunting Maturity Model provided in this Skill. Input your program characteristics to evaluate capabilities and identify specific areas for improving adversary-centric detection and hunting operations.

How to prioritize detection rules using adversary cost?▼

Prioritize detection rules by applying Python scripts to analyze your current coverage against the Pyramid of Pain. This identifies gaps in TTP detection and guides hunt hypotheses targeting the most impactful adversary behaviors.

Does this threat hunting framework work with MITRE ATT&CK?▼

Yes, the framework aligns with MITRE ATT&CK by evaluating detection rules against TTPs. It helps map your current detection capabilities to adversary behaviors, ensuring hunt activities target high-value techniques rather than just low-level indicators.

Do I need PyYAML to run the detection strategy scripts?▼

Yes, PyYAML is a required dependency for running the Python scripts. You need this library installed to parse configuration files and execute the threat hunting maturity assessment and detection analysis routines.

What is the best way to plan a threat hunt using TTPs?▼

The best way to plan a threat hunt using TTPs is to evaluate existing detection rules for gaps, then build hunt hypotheses targeting adversary behaviors at the top of the Pyramid of Pain to maximize operational disruption.