Hash Values
Trivial
One changed bit produces a new hash. Useful for exact-match lookup and nothing else.
IP Addresses
Easy
New infrastructure is minutes and pennies away. Shared hosting makes the same address innocent and guilty at once.
Domain Names
Simple
Registration and propagation cost a little time and money.
Network and Host Artifacts
Annoying
Registry keys, file paths, user-agent quirks, process relationships. Changing these means changing how the tool works.
Tools
Challenging
Forces the adversary to find, build or buy a replacement capability and learn it.
Tactics, Techniques, and Procedures
Tough
Changing how an operator actually works costs the most and is hardest to fake.