Cyber Kill Chain and Diamond Model

The Cyber Kill Chain, developed by Lockheed Martin in 2011, is a framework that describes the stages of a cyber attack. It is based on military concepts of a 'kill chain' – a systematic process to identify, target, and engage an adversary. In cybersecurity, it models the steps an attacker must take to successfully compromise a network. The original seven phases are: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control (C2), and Actions on Objectives.

The Diamond Model, introduced by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz in 2013, is a more analytical framework that focuses on the relationships between four core components: Adversary, Victim, Capability, and Infrastructure. It emphasizes that every intrusion event is a diamond with these four vertices, connected by edges representing their relationships. The model also includes meta-features (e.g., timestamp, phase, result, direction, methodology, resources) and social-political-economic context.

The Cyber Kill Chain is linear and sequential. It assumes that an attacker must progress through each phase to achieve their goal. However, in practice, attackers may loop back or skip phases (e.g., using a USB drop bypasses delivery via email). The model helps defenders identify where they can break the chain. For example, if you can block delivery (e.g., email filtering), you prevent the attack from progressing.

The Diamond Model is event-focused. Each event is a diamond with four vertices: - Adversary: The threat actor (individual, group, organization). - Victim: The target (organization, person, asset). - Capability: The tools, techniques, and malware used. - Infrastructure: The systems and networks used by the adversary (e.g., C2 servers, domains).

Edges connect vertices: Adversary uses Capability via Infrastructure against Victim. The model also includes event metadata like timestamp, phase (from kill chain), result (success/failure), direction (victim to infrastructure or vice versa), methodology (e.g., spear-phishing), and resources (e.g., knowledge, funding).

Cyber Kill Chain Phases (Lockheed Martin): 1. Reconnaissance: Research, identification, and selection of targets. Examples: harvesting email addresses, scanning for open ports. 2. Weaponization: Coupling a payload with a delivery mechanism (e.g., exploit with a dropper). Typically creates a deliverable like a malicious document. 3. Delivery: Transmission of the weapon to the target. Methods: email attachments, USB drives, web downloads. 4. Exploitation: Triggering the weapon to exploit a vulnerability. Often involves code execution. 5. Installation: Installing malware or backdoor on the victim system. 6. Command and Control (C2): Establishing a channel to control the compromised system remotely. 7. Actions on Objectives: Achieving the attacker's goal (e.g., data exfiltration, encryption for ransomware).

Diamond Model Core Vertices: - Adversary: Can be internal (insider) or external. The model distinguishes between adversary (the actor) and operator (the person executing the attack). - Victim: Can be an organization, person, or asset. Often includes victim persona (e.g., CEO) and victim assets (e.g., database). - Capability: The malware or exploit. Includes capability capacity (e.g., polymorphic) and capability type (e.g., remote access trojan). - Infrastructure: The physical or virtual systems used. Includes command and control servers, domains, IP addresses. Can be malicious (owned by adversary) or compromised (hijacked).

Meta-Features: - Timestamp: When the event occurred. - Phase: The kill chain phase (e.g., Delivery). - Result: Success, failure, or unknown. - Direction: Victim-to-infrastructure (e.g., beaconing) or infrastructure-to-victim (e.g., exploit). - Methodology: The general class of activity (e.g., spear-phishing, watering hole). - Resources: The resources required for the event (e.g., software, knowledge, funding).

These frameworks are not configured like software; they are analytical tools. However, security teams operationalize them through: - Kill chain mapping: Each detection alert is mapped to a phase. For example, an intrusion detection system (IDS) alert for a known exploit signature maps to the Exploitation phase. - Diamond model event construction: For each incident, analysts fill out a diamond template. Tools like MITRE ATT&CK integrate with the diamond model. - Verification commands: In a SIEM, you might query for events matching a specific kill chain phase. For example, to detect delivery, you might search for email logs with malicious attachments:

index=email sourcetype=mail_logs attachment_name=*.exe | stats count by sender, recipient

For C2 detection, you might look for beaconing patterns:

index=network sourcetype=proxy dest_ip=185.220.101.0/24 | timechart count by src_ip

The Cyber Kill Chain and Diamond Model complement other frameworks: - MITRE ATT&CK: Provides a detailed taxonomy of tactics and techniques that map to kill chain phases. For example, ATT&CK tactic 'Initial Access' maps to the Delivery phase. The diamond model can be extended with ATT&CK techniques as capabilities. - Unified Kill Chain: An extended version that adds phases like 'Lateral Movement' and 'Impact' to better cover modern attacks. - NIST Incident Response: The kill chain helps identify where detection and prevention controls are needed, while the diamond model helps analyze adversary behavior. - Threat Intelligence: The diamond model is used to structure threat intelligence reports, linking adversaries to their capabilities and infrastructure.

When analyzing an intrusion, an analyst might: 1. Identify a suspicious email (Delivery phase). 2. Extract the attachment and analyze it (Weaponization phase). 3. Determine if the attachment exploited a vulnerability (Exploitation). 4. Check for subsequent connections to external IPs (C2). 5. Build a diamond: Adversary (unknown), Victim (the company), Capability (the malware), Infrastructure (the C2 server). 6. Use the diamond to pivot: Search for other events with the same infrastructure or capability.

The CS0-003 exam expects you to:

Common trap: Candidates confuse the 'Exploitation' phase with 'Installation' or think the kill chain is always followed in order. The exam might present a scenario where an attacker uses a USB drop, skipping the delivery phase. You must recognize that the kill chain still applies but with a different delivery method.

Another trap: The diamond model has four vertices, but candidates forget meta-features. The exam may ask what additional information should be included, and the answer is meta-features like timestamp or phase.

A large bank detects unusual outbound traffic from a server in the DMZ. The security team uses the Cyber Kill Chain to map the event: the initial compromise occurred via a phishing email (Delivery) that exploited an unpatched browser (Exploitation), installed a backdoor (Installation), and then beaconed to a foreign IP (C2). The team constructs a Diamond Model: Adversary (suspected APT group 'SilverFish'), Victim (the bank's web server), Capability (a custom backdoor 'BlindEye'), Infrastructure (IP 5.5.5.5). By pivoting on the C2 IP, they find three other servers with similar beacons. The kill chain helps them prioritize containment: they block the C2 IP at the firewall (breaking the C2 phase) and isolate the infected servers. The diamond model is shared with threat intelligence partners, who link the same IP to attacks on other banks. In production, this approach reduces incident response time by 40% and improves detection of lateral movement.

A cloud security engineer monitors AWS CloudTrail logs for suspicious API calls. They use the kill chain to hypothesize that an attacker might be in the Reconnaissance phase (scanning for open S3 buckets). They set up a detection for unusual 'ListBuckets' calls. When triggered, they build a diamond: Adversary (unknown external), Victim (the AWS account), Capability (AWS CLI tools), Infrastructure (source IP from a known VPN provider). The meta-feature 'phase' is Reconnaissance. The engineer then searches for other events from the same IP (infrastructure) to see if it progressed to Delivery (e.g., uploading a malicious file). This proactive hunting prevents a potential data breach. Common mistake: ignoring the meta-feature 'direction' – in this case, the direction is infrastructure-to-victim (the attacker's IP scanning the victim's S3). Misconfiguring the diamond by omitting meta-features leads to incomplete analysis.

A Managed Security Service Provider (MSSP) uses the Diamond Model to structure threat intelligence feeds. For each adversary group, they maintain a diamond with known capabilities and infrastructure. When a client reports a new incident, the MSSP automatically correlates it with existing diamonds. For example, a client's alert for a PowerShell script (capability) connecting to a specific domain (infrastructure) matches a known diamond for the 'DarkHydrus' group. The MSSP then provides the client with the full kill chain phases that DarkHydrus typically uses (e.g., spear-phishing, then C2 via DNS tunneling). This enables the client to implement preventive controls for future attacks. Performance consideration: the diamond database must be indexed by capability hash and infrastructure IP for fast correlation. If the database is not normalized, false positives increase.