CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK

Attack methodology frameworks are shared models that describe how intrusions unfold, so analysts can place each piece of evidence in context, compare intrusions with each other and decide where a defence would have the most effect. CS0-004 objective 3.1 names three: the Cyber Kill Chain, the Diamond Model of Intrusion Analysis and MITRE ATT&CK. They are not competitors. Each answers a different question about the same intrusion:

This lesson covers what each framework contains and how analysts apply and combine them. The response process itself belongs to objective 3.2, and hands-on containment and evidence handling to objective 3.3. Using ATT&CK for threat hunting, Navigator heat maps and the Pyramid of Pain are taught in the objective 1.4 lesson on threat intelligence and threat hunting.

The Cyber Kill Chain, published by Lockheed Martin researchers Hutchins, Cloppert and Amin in 2011, divides an intrusion into seven ordered phases, and the attacker must complete each one to reach the next. Mapping evidence to a phase means asking what the adversary was trying to achieve at that step:

Placing evidence in the right phase

• Where did it stop? The furthest phase reached is the last one the evidence proves. If a watering-hole page served an exploit to a browser that was already patched, the weapon arrived but nothing ran, so the evidence proves delivery and no more.
• Most recent completed phase. Work forward through the evidence and stop at the first phase with nothing in it. A server that shows a new service launching an implant and steady check-ins to an outside host, but no file access or staging, has completed command and control; actions on objectives has not begun.
• Order the phases, not the logs. Clocks on different tools drift, and some records carry no usable time at all. Assign each record to a phase first; the phase order then tells you the sequence of the intrusion.
• Persistence is installation; check-ins are C2. Anything that makes the implant survive a reboot or logoff belongs to installation. Traffic in which the implant asks for or receives instructions is C2, whatever protocol carries it.

What happens in the weaponization phase?

Weaponization is the step in which the adversary pairs an exploit with a backdoor or remote-access payload and packages them into something deliverable, such as a document that exploits a reader flaw and drops a trojan. It happens entirely on the attacker's side, before any message reaches the target, so defenders cannot observe it as it happens.

Defenders learn about weaponization from the artifacts the build process leaves in the payload, such as the packer or compiler used, a template the builder stamps into every file, or code reused from an earlier sample. An indicator of this kind is a weaponization indicator because it describes how the payload was made.

The original paper stresses that detections keyed to weaponizer artifacts are among the most durable: actors change lures, sender addresses and infrastructure often, but they tend to reuse the same builder tools. That makes weaponization artifacts a valuable source of indicators that persist across intrusions.

The courses-of-action matrix pairs each kill chain phase with six defensive actions (detect, deny, disrupt, degrade, deceive and destroy) so a team can see which controls it has, and where the gaps are, phase by phase. The actions mean:

Telling the near-twins apart

• Deny vs disrupt. Deny removes the possibility before the attack starts, for example by removing a vulnerability or closing a port. Disrupt leaves the opportunity in place but stops the attack while it runs, as an inline IPS does when it drops a malicious session part-way through.
• Deceive is the one that lies. Deceive hands the adversary something false, such as decoy credentials, a honeypot share or a fake server, and usually gains the defender information as it does. The other actions work on the adversary's real activity by preventing, interrupting or slowing it.
• The phase is where the control acts. Name the phase from the activity the control interrupts, not from where the control is installed.

Why break the chain as early as possible?

Every phase depends on the one before it, so stopping an intrusion at any phase stops everything after it, and the earlier the break, the less the adversary achieves. A control at delivery or exploitation prevents installation, C2 and actions on objectives altogether; a control at C2 only acts after the attacker already has code running on your systems.

The second half of the principle is durability. Hutchins and colleagues describe intelligence-driven defence: analyse each intrusion (including the ones you stopped), find the indicators that repeat across intrusions by the same actor, and build controls on those. Atomic indicators such as file hashes, IP addresses and domain names are cheap for an actor to change, so a blocklist of them rarely stops the next intrusion. Behaviour the actor repeats (its preferred delivery method, a characteristic chain of processes on the endpoint, a reused builder) keeps working even when infrastructure changes.

When choosing a control, ask two questions together: which phase does it act at? and will the adversary still be doing this next time? The best choices score well on both. When the first alert in an intrusion fired late in the chain, look back through the telemetry you already hold for the earliest phase it recorded, and build the new rule there.

Analysing intrusions that were stopped matters too: a blocked attempt still reveals the actor's reconnaissance, weaponization and delivery choices, which become indicators for the next attempt.

The kill chain models an outside attacker who must deliver and exploit a payload to get in, so it fits malware-driven intrusions well and other threats poorly. Its main limitations:

• Insiders. An employee or contractor with legitimate access needs no weaponization, delivery, exploitation or installation. Almost everything they do lands in actions on objectives, leaving most of the chain empty.
• Post-compromise compression. Credential dumping, discovery, lateral movement, collection and the final impact all fall into the single final phase. Weeks of activity after the initial foothold become one box, too coarse to compare against detection rules. ATT&CK splits that same activity into separate tactics and techniques.
• Linearity. Real intrusions loop: an attacker who moves laterally repeats exploitation and installation on each new host. The chain has no sub-phases for this.
• Perimeter and malware focus. Attacks that need no malware, such as abuse of valid accounts, cloud console misuse or social engineering of a help desk, map awkwardly.

Its strength is the one these limits leave intact: a clear, ordered picture of progress that non-specialists can read.

The Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) represents each intrusion event as four connected core features: adversary, capability, infrastructure and victim. Its axiom: for every intrusion event, an adversary takes a step towards a goal by using a capability over infrastructure against a victim. Each event is one step, such as a phishing email or a beacon, and many events make up an intrusion.

Features are assigned by the role they play in the event being analysed. In a watering-hole event, the compromised news site that served the exploit is infrastructure; the exploit kit and the implant it installs are capability; the visitor's laptop is a victim asset; the actor behind it is the adversary. Features can be unknown: an event is still recorded when the adversary has not been identified, and each feature carries a confidence value.

Meta-features

Meta-features add context to an event. They are not part of the diamond itself:

• Timestamp: when the event started and ended.
• Phase: the event's place in a sequence. The model deliberately borrows an external phase model, commonly the Cyber Kill Chain, to fill this in.
• Result: the outcome (success, failure, unknown) and which security property was affected.
• Direction: the path of the event between features, for example victim-to-infrastructure (stolen data sent from a victim server to an actor upload site), infrastructure-to-victim (a payload delivered) or bidirectional.
• Methodology: the general class of activity, such as spear-phishing, port scan or denial of service.
• Resources: what the event needed, such as software, knowledge, money, facilities or access.

The extended model

The extended Diamond adds two meta-features along the diamond's axes:

• Social-political (the adversary–victim axis): the relationship and motive between them, such as why this adversary wants this victim.
• Technology (the capability–infrastructure axis): how the capability uses the infrastructure, for example malware that hides its C2 traffic inside a legitimate cloud storage API. Recording this tells defenders which channels a control has to cover.

The Diamond Model splits infrastructure by who controls it: Type 1 is controlled or owned by the adversary, Type 2 is controlled by an intermediary. Service providers form a third category.

The deciding question is control in this event, not how it was paid for. How the actor obtained a system (bought it, used fraud, got it free) does not change its type; what matters is whether the actor or an unwitting third party runs it. Type 2 infrastructure obscures the adversary's identity, because traces lead to the intermediary.

The same system can play different roles in different events. A partner's breached VPN appliance that relays an actor's connections into your network is infrastructure in that event; in a separate event describing how the partner was breached, the same appliance is a victim asset.

Analytic pivoting means taking one known feature of an event and using it, with data sources, to discover related features: from a victim to the capability that ran on it, from that capability to the infrastructure it contacts, from that infrastructure to other victims. The edges of the diamond are the pivot paths.

The model names centered approaches by the starting feature:

Name the approach from the starting feature and the pivot from where you end up. Starting from a suspicious domain in your proxy logs and using passive DNS to find other domains on the same address is infrastructure-centered analysis pivoting to further infrastructure; if you then look up malware samples that contact those domains, the pivot has reached capability. Each approach depends on a different kind of data (the Needs column), so the sources you actually have decide which ones are open to you.

Activity threads, activity-attack graphs and activity groups

The Diamond Model builds three larger structures from events: activity threads order the events of one intrusion, activity-attack graphs add the paths an adversary could take, and activity groups cluster many intrusions under one tracked adversary set.

An attack graph alone shows only what could happen; a thread alone shows only what did. The activity-attack graph combines them. Building an activity group follows a defined process: state the analytic problem, select the features to cluster on, create the group, grow it as new events arrive, analyse it and redefine it as understanding changes. Grouping is based on observed features, so a group can exist long before anyone names the adversary behind it.

MITRE ATT&CK is a curated knowledge base of real-world adversary behaviour, organised as tactics (the adversary's goal at a step), techniques (how it achieves the goal) and sub-techniques (more specific ways), each with a stable identifier. It is not a sequence: an intrusion can use tactics in any order and return to them.

Matrices and platforms

ATT&CK has three technology domains: Enterprise (Windows, macOS, Linux, cloud, network devices, containers and similar platforms), Mobile (Android and iOS) and ICS (industrial control systems, such as PLCs, HMIs and safety controllers). Cloud is a set of platforms inside the Enterprise domain, not a separate domain.

Older material may refer to PRE-ATT&CK, a separate matrix of pre-compromise activity. It was retired in 2020 and its content moved into two Enterprise tactics: Reconnaissance (gathering information about the target) and Resource Development (acquiring or building resources, such as Acquire Infrastructure, T1583, whose sub-techniques cover domains, servers and similar). Learning about the victim is reconnaissance; preparing your own tools and infrastructure is resource development.

Groups vs campaigns vs software

A group page aggregates everything an actor has been reported doing over the years. A campaign page is time-bound: use it when you need only the techniques from one named operation. A software page covers one tool or malware family. The tool or malware type matters when writing detections: a tool may also be in legitimate use by your own administrators, so rules for it need context such as the account, host or time rather than a blanket block.

During incident response, analysts map each observed behaviour to a technique and record the tactic that matches the adversary's goal at that step, then use the technique entries to drive remediation and detection.

One technique, several tactics

Many techniques appear under more than one tactic. Valid Accounts (T1078) is listed under Initial Access, Persistence, Privilege Escalation and Defense Evasion; Scheduled Task/Job (T1053) under Execution, Persistence and Privilege Escalation. Record the tactic the step actually achieved:

• Signing in to a cloud console with a phished employee password is Valid Accounts used for Initial Access. Re-enabling a dormant service account so the intruder can come back after the phished password is reset is Valid Accounts used for Persistence.
• An intruder who uses a scheduled task once to launch a script on a remote host is using Scheduled Task/Job for Execution. A standard user who registers a task that runs as a more privileged account, to gain that account's rights, is using it for Privilege Escalation. Ask what the step gave the adversary that it did not already have.

Getting the tactic right keeps heat maps and remediation plans accurate: the same technique needs different responses depending on what the attacker used it for.

From technique to defence

• Defences hang off techniques. ATT&CK attaches mitigations and detection guidance (in current releases, detection strategies) to each technique and sub-technique. Brute Force (T1110), for example, lists Multi-factor Authentication and Account Use Policies among its mitigations.
• Mitigations link back. Each mitigation page lists every technique it addresses, so a mitigation can be read in either direction: from a technique to its controls, or from a control to everything it helps against.
• Use the granularity for gap analysis. Breaking post-compromise activity into credential access, discovery, lateral movement, collection, exfiltration and impact techniques lets a detection team compare each step against its existing rules. That is the detail the kill chain's final phase lacks.

Choose the framework by the question and the audience, and combine them in a single investigation: the kill chain for progress, the Diamond Model for relationships, ATT&CK for granular behaviour.

How they connect

• The Diamond Model has no phases of its own. Its phase meta-feature borrows an external phase model, and the kill chain is the usual choice for sequencing events.
• ATT&CK supplies detail where the kill chain is broad: most of what happens after the foothold falls in the kill chain's last phase, while ATT&CK spreads it across many tactics.