There are a few ways that the good guys find the bad guys lurking around within their systems. Two of these ways is by using the Cyber Kill Chain and the Diamond Model of Intrusion.
These can help an analyst determine at what point of an attacker is at a given time and how they should focus their investigation.
The Cyber Kill Chain and the Diamond Model of Intrusion Analysis are two frameworks used in cybersecurity to understand and analyse cyberattacks.
Cyber Kill Chain
Developed by Lockheed Martin, the Cyber Kill Chain outlines the different stages of a cyberattack, from initial reconnaissance to data exfiltration.
https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
Seven Stages of the Cyber Kill Chain
Reconnaissance – Attackers gather information about the target (e.g., scanning networks, collecting employee emails).
Weaponisation – The attacker creates malware or exploits (e.g., crafting a phishing email with a malicious attachment).
Delivery – The attacker sends the weapon to the target (e.g., phishing emails, drive-by downloads).
Exploitation – The malicious code is executed (e.g., exploiting a vulnerability to gain access).
Installation – The malware installs a backdoor for persistence.
Command and Control (C2) – The attacker establishes remote control over the compromised system.
Actions on Objectives – The attacker executes their goal, such as stealing data or deploying ransomware.
What is it used for?
Helps in detecting, preventing, and responding to cyber threats.
Focuses on breaking the chain at any stage to stop the attack.
Diamond Model of Intrusion Analysis
The Diamond Model provides a more structured and flexible way to analyse cyber intrusions by looking at four core elements.
Four Components of the Diamond Model
- Adversary – The attacker or threat actor.
- Capability – The tools, malware, or exploits used.
- Infrastructure – The attacker’s resources for example command-and-control servers.
- Victim – The target of the attack.
How It Works
It allows for link analysis, helping track patterns and relationships in cyberattacks.
These four components form a diamond shape, showing how they relate.
Analysts can pivot between elements (e.g., identifying other victims targeted by the same infrastructure).
Uses of the Diamond Model
Helps in threat intelligence by identifying relationships between different attacks.
Useful for advanced persistent threats (APTs) and mapping attack patterns.
Example use
1. Adversary – Who is behind the attack?
The attack is attributed to APT29 (Cozy Bear), a well-known nation-state threat group.
2. Capability – What tools or exploits were used?
The attack vector was a spear phishing email containing a malicious Excel file.
3. Infrastructure – What resources did the attacker use?
The phishing emails were sent from a spoofed domain resembling the company’s HR portal.
4. Victim – Who was targeted?
A senior HR manager received the phishing email and unknowingly opened the malicious attachment.
Click below for more explanations and other interesting blog posts:
Leave a Reply