4.1.2. Diamond Model and MITRE ATT&CK

💡 First Principle: Where the Kill Chain describes attack sequence, the Diamond Model and MITRE ATT&CK describe attack composition — who is attacking (adversary), what they're targeting (victim), how they're doing it (capability), and what they're using to do it (infrastructure). Together they enable attribution, TTP analysis, and systematic detection coverage.

The Diamond Model of Intrusion Analysis

The Diamond Model represents every intrusion event as four interconnected vertices:

• Adversary — Who is conducting the attack (threat actor, group, nation-state)
• Capability — What tools, malware, and techniques they're using (custom RAT, Cobalt Strike, spear-phishing kit)
• Infrastructure — What they're using to deliver and control the attack (C2 servers, phishing domains, compromised VPS)
• Victim — Who or what is being targeted (organization, specific individual, specific system)

The model's power lies in pivoting: if you identify the infrastructure (a C2 IP), you can pivot to find what other victims are connecting to it (victim discovery), what malware uses that IP (capability analysis), and who typically uses that infrastructure (adversary attribution).

MITRE ATT&CK Framework

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a comprehensive, community-maintained matrix of adversary TTPs organized by:

• Tactics (15 columns in ATT&CK v19): the adversary's goal at each stage — Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth (TA0005, formerly Defense Evasion), Defense Impairment (TA0112, new in v19), Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact
• Techniques (hundreds): specific methods used to achieve each tactic (e.g., T1059 — Command and Scripting Interpreter)
• Sub-techniques: further specificity (T1059.001 — PowerShell; T1059.003 — Windows Command Shell)

For analysts, ATT&CK enables:

• Detection coverage mapping: do you have a detection rule for every technique relevant to your threat actors?
• Hunt hypothesis generation: "Based on ATT&CK T1003 (OS Credential Dumping), I'll hunt for lsass.exe memory access by non-system processes"
• Incident documentation: precise, shared vocabulary for describing attacker behavior in reports
• Red team planning: structured adversary simulation using real-world TTPs

OSSTMM (Open Source Security Testing Methodology Manual) provides a structured methodology for security testing — defining what to test, how to measure security, and how to document results. More commonly referenced in penetration testing than in daily SOC operations, but the CySA+ exam expects awareness of it as a testing framework.

OWASP Testing Guide provides specific methodology for web application security testing — test cases for each OWASP Top 10 category and beyond. The de facto standard for web application security assessments.

⚠️ Exam Trap: MITRE ATT&CK is descriptive, not prescriptive — it documents what attackers have done, not a step-by-step attack recipe. Defenders use it to ensure detection coverage against known techniques; it doesn't mean attackers will follow the matrix exactly. Also: ATT&CK is not the same as ATT&CK for ICS (a separate matrix for operational technology environments).

Diamond Model: Meta-Features, Threads, and Groups

Beyond the four core features, each Diamond event carries meta-features that give it context:

The extended model adds two more. Social-political describes the relationship between adversary and victim: why this victim was chosen and what it offers. It explains why organizations with the same profile share a threat space and gain the most from sharing intelligence. Technology describes how capability and infrastructure interact, for example malware using DNS to find its C2.

• Activity thread: one intrusion's events ordered by phase and linked by cause. It reconstructs what happened and exposes missing steps.
• Activity group: similar events and threads clustered to identify a common adversary or campaign.
• Centered approaches: begin analysis from any one feature. For example, a victim-centered approach watches a high-value target to discover new capabilities and infrastructure used against it.

ATT&CK Navigator is MITRE's web tool for building layers, which are custom views of the matrix with colored, scored, and commented cells. Teams use it to show detection coverage against the techniques used by the groups they track.

⚠️ Exam Trap: An event's outcome belongs to the result meta-feature, not to the victim or capability vertex.

Reading ATT&CK in Practice

• Data sources. Each technique page lists the data sources that can reveal it. For Valid Accounts (T1078, with sub-techniques for default, domain, local and cloud accounts) the common thread is authentication telemetry: Windows Security logon events, identity-provider sign-in logs (such as Microsoft Entra ID, formerly Azure AD) and cloud provider authentication logs cover every sub-technique, while file-system, DNS or firewall logs do not.
• Discovery techniques use built-in tools. Account Discovery (T1087), Permission Groups Discovery (T1069) and Remote System Discovery (T1018) run commands such as net user /domain, net group "Domain Admins" /domain and Get-ADUser, or tools such as BloodHound, so there is no malware to signature. Detect them through process-creation telemetry (EDR, or Sysmon event ID 1) and alert on bursts of enumeration commands. The same chain (explorer.exe, then cmd.exe, then net.exe /domain) appearing on several hosts within minutes points to scripted attacker discovery rather than users troubleshooting. MFA and perimeter firewalls do not stop an already-authenticated attacker from enumerating the domain.
• Impact. Ransomware often runs vssadmin.exe delete shadows /all /quiet just before encrypting; that maps to Inhibit System Recovery (T1490) in the Impact tactic.
• Example techniques per tactic. Initial Access: spearphishing attachment (T1566.001). Execution: PowerShell (T1059.001). Persistence: Run keys (T1547.001) or scheduled tasks (T1053.005). Credential Access: LSASS memory (T1003.001). Exfiltration: exfiltration over C2 channel (T1041).

Reflection Question: An analyst investigating an incident finds that the attacker used legitimate Windows admin tools (net.exe, wmic.exe, psexec.exe) for lateral movement with stolen credentials, leaving no malware on compromised systems. Why does this type of attack challenge signature-based detection, and which MITRE ATT&CK tactic category specifically addresses attacker techniques designed to blend in with legitimate activity?