skills.rest
copyleftdev
copyleftdevCOMMUNITY
Explore all skills by this author →
GitHub

bianco-pyramid-of-pain

Apply the Pyramid of Pain and Threat Hunting Maturity Model to prioritize detection strategies.

Updated Jan 24, 2026
Search Tags:#threat hunting#security operations#mitre att&ck#detection engineering#pyramid of pain#adversary emulation
One-click install
npx skills add https://github.com/copyleftdev/sk1llz --skill bianco-pyramid-of-pain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bianco-pyramid-of-pain
Source: https://github.com/copyleftdev/sk1llz/tree/main/domains/security/threat-hunting/bianco
Command: npx skills add https://github.com/copyleftdev/sk1llz --skill bianco-pyramid-of-pain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires PyYAML, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security teams prioritize their detection and hunting efforts by focusing on indicators that cause the most "pain" for adversaries, making their operations more costly and difficult.

Core Features & Use Cases

  • Pyramid of Pain Framework: Understand and apply David Bianco's model, ranking indicators from low-value hashes to high-value TTPs.
  • Threat Hunting Maturity Model: Assess and improve your organization's threat hunting capabilities.
  • Detection Strategy Guidance: Implement patterns for building effective, adversary-centric detection rules and hunt hypotheses.
  • Use Case: A security analyst can use this Skill to evaluate their current detection rules, identify gaps in TTP coverage, and plan hunts that target the most impactful adversary behaviors.

Quick Start

Use the bianco-pyramid-of-pain skill to assess the maturity of a threat hunting program based on provided characteristics.

Frequently Asked Questions about bianco-pyramid-of-pain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the Pyramid of Pain in threat hunting and detection engineering?▼

The Pyramid of Pain is a threat hunting framework ranking indicators from low-value hashes to high-value TTPs. It helps prioritize detection strategies by focusing on adversary behaviors that cause the most operational cost when blocked.

How do I assess my threat hunting program maturity?▼

Assess threat hunting maturity using the Threat Hunting Maturity Model provided in this Skill. Input your program characteristics to evaluate capabilities and identify specific areas for improving adversary-centric detection and hunting operations.

How to prioritize detection rules using adversary cost?▼

Prioritize detection rules by applying Python scripts to analyze your current coverage against the Pyramid of Pain. This identifies gaps in TTP detection and guides hunt hypotheses targeting the most impactful adversary behaviors.

Does this threat hunting framework work with MITRE ATT&CK?▼

Yes, the framework aligns with MITRE ATT&CK by evaluating detection rules against TTPs. It helps map your current detection capabilities to adversary behaviors, ensuring hunt activities target high-value techniques rather than just low-level indicators.

Do I need PyYAML to run the detection strategy scripts?▼

Yes, PyYAML is a required dependency for running the Python scripts. You need this library installed to parse configuration files and execute the threat hunting maturity assessment and detection analysis routines.

What is the best way to plan a threat hunt using TTPs?▼

The best way to plan a threat hunt using TTPs is to evaluate existing detection rules for gaps, then build hunt hypotheses targeting adversary behaviors at the top of the Pyramid of Pain to maximize operational disruption.

Related Skills

Explore More Software Engineering Skills→
infantesromeroadrianinfantesromeroadrian

pentest-detection-engineer

Generate detection rules in Sigma, Splunk SPL, KQL, YARA, and Snort formats.

Community
Advanced
BrunoSantanaDeveloperBrunoSantanaDeveloper

red-team-tactics

Automate adversary-simulation planning and reporting with MITRE ATT&CK tactics.

Community
Advanced
rajyeole6rajyeole6

agency-threat-intelligence-analyst

Analyze raw cyber threat data into intelligence reports and detection rules.

Community
Advanced
MHaggisMHaggis
471

Atomic Red Team Testing

Execute and validate Atomic Red Team adversary emulation tests across SIEMs.

Community
Advanced