4.1.2. Diamond Model and MITRE ATT&CK

💡 First Principle: Where the Kill Chain describes attack sequence, the Diamond Model and MITRE ATT&CK describe attack composition — who is attacking (adversary), what they're targeting (victim), how they're doing it (capability), and what they're using to do it (infrastructure). Together they enable attribution, TTP analysis, and systematic detection coverage.

The Diamond Model of Intrusion Analysis

The Diamond Model represents every intrusion event as four interconnected vertices:

• Adversary — Who is conducting the attack (threat actor, group, nation-state)
• Capability — What tools, malware, and techniques they're using (custom RAT, Cobalt Strike, spear-phishing kit)
• Infrastructure — What they're using to deliver and control the attack (C2 servers, phishing domains, compromised VPS)
• Victim — Who or what is being targeted (organization, specific individual, specific system)

The model's power lies in pivoting: if you identify the infrastructure (a C2 IP), you can pivot to find what other victims are connecting to it (victim discovery), what malware uses that IP (capability analysis), and who typically uses that infrastructure (adversary attribution).

MITRE ATT&CK Framework

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a comprehensive, community-maintained matrix of adversary TTPs organized by:

• Tactics (14 columns): the adversary's goal at each stage — Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact
• Techniques (hundreds): specific methods used to achieve each tactic (e.g., T1059 — Command and Scripting Interpreter)
• Sub-techniques: further specificity (T1059.001 — PowerShell; T1059.003 — Windows Command Shell)

For analysts, ATT&CK enables:

• Detection coverage mapping: do you have a detection rule for every technique relevant to your threat actors?
• Hunt hypothesis generation: "Based on ATT&CK T1003 (OS Credential Dumping), I'll hunt for lsass.exe memory access by non-system processes"
• Incident documentation: precise, shared vocabulary for describing attacker behavior in reports
• Red team planning: structured adversary simulation using real-world TTPs

OSSTMM (Open Source Security Testing Methodology Manual) provides a structured methodology for security testing — defining what to test, how to measure security, and how to document results. More commonly referenced in penetration testing than in daily SOC operations, but the CySA+ exam expects awareness of it as a testing framework.

OWASP Testing Guide provides specific methodology for web application security testing — test cases for each OWASP Top 10 category and beyond. The de facto standard for web application security assessments.

⚠️ Exam Trap: MITRE ATT&CK is descriptive, not prescriptive — it documents what attackers have done, not a step-by-step attack recipe. Defenders use it to ensure detection coverage against known techniques; it doesn't mean attackers will follow the matrix exactly. Also: ATT&CK is not the same as ATT&CK for ICS (a separate matrix for operational technology environments).

Reflection Question: An analyst investigating an incident finds that the attacker used legitimate Windows admin tools (net.exe, wmic.exe, psexec.exe) for lateral movement with stolen credentials, leaving no malware on compromised systems. Why does this type of attack challenge signature-based detection, and which MITRE ATT&CK tactic category specifically addresses attacker techniques designed to blend in with legitimate activity?