Sergio Caltagirone, Andrew Pendergast, Christopher Betz

1 card

1. 01

   An intrusion event has four corners — adversary, capability, infrastructure, victim — linked by edges the analyst pivots along: from a domain to all its victims, from a tool to the adversary who uses it; ATT&CK then gives every behaviour a common name, so two teams can talk about the same technique.

   The Diamond Model of Intrusion Analysis · 2013

   Four corners, pivot along the edges, name the technique with ATT&CK — and say which edge the attribution rests on.

   The Diamond Model formalises what intrusion analysts do intuitively: "an adversary deploys a capability over some infrastructure against a victim". The four core features are the vertices; the meta-features (time, phase, result, direction, methodology, resources) order events into activity threads. The authors say explicitly that at discovery most features are unknown and get filled in as facts emerge. The value is in pivoting: you know a C2 domain (infrastructure) → you look for which other victims talked to it → you find the shared capability → you group the events under one adversary. Every edge is a hypothesis to test, not a fact; the model forces you to say which edge you relied on. ATT&CK, published by MITRE since 2015 and described in the 2020 methodology paper, is complementary: "a curated knowledge base and model for cyber adversary behavior", organised into tactics (the short-term goal: initial access, persistence, lateral movement, exfiltration), techniques (how the goal is achieved) and procedures (a group's concrete implementation). It is explicitly "not an exhaustive enumeration of attack vectors" — it is a vocabulary. When a report says "T1053 — scheduled task", two organisations know they are talking about the same thing and can compare detection coverage. How the three frames connect: the chain (lesson 30) says which phase you are in, Diamond says who-with-what-through-what-against-whom, ATT&CK names the technique. The shared trap: attribution. An "adversary" corner filled in on the strength of a single reused piece of infrastructure is a low-confidence hypothesis, however convincing the group's name sounds.

   “For every intrusion event there exists an adversary taking a step towards an intended goal by using a capability over infrastructure against a victim to produce a result.”

   Open the card →