Security Policies and Procedures · Topic 7 of 7
Cyber Kill Chain and Diamond Model
Classify intrusion events with the Cyber Kill Chain stages and the Diamond Model of Intrusion Analysis, and learn how the two models complement each other.
- 5 min
- Includes a diagram
- The kill chain has seven stages, from reconnaissance to actions on objectives.
- The order is reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
- Breaking any link in the chain can stop the attack.
What it is
The Cyber Kill Chain and the Diamond Model are two ways to organise what you know about an intrusion.
The kill chain describes the stages of an attack in order. The Diamond Model describes the four parts that every event has, and how they relate.
Analysts use them to classify events, to find gaps in knowledge and to decide where to break the attack.
How it works
The kill chain gives the order of an attack, and the Diamond Model gives the features of each event.
The Cyber Kill Chain
Lockheed Martin described seven stages. The attacker must complete each one, so defenders can stop the attack by breaking any link.
| Stage | What the attacker does | Example evidence |
|---|---|---|
| Reconnaissance | Researches the target and looks for weak points | Port scans, web crawling, social media research |
| Weaponization | Builds or prepares the attack payload | A document with an exploit, a remote access tool paired with it |
| Delivery | Sends the weapon to the target | A phishing email, a malicious link, an infected USB drive |
| Exploitation | Triggers a weakness to run the code | A vulnerable application crashes and runs attacker code |
| Installation | Plants malware to stay on the system | A new service, a run key, a web shell |
| Command and control | Opens a channel to control the host | Regular beaconing to an external address |
| Actions on objectives | Carries out the goal | Data theft, encryption of files, damage |
Weaponization happens on the attacker side, so defenders rarely see it directly. They may find its results later, in a captured sample.
A phishing case shows the order. Research on the staff is reconnaissance, and a document with a macro is the weapon.
The email is delivery, the macro running is exploitation, and the dropped program is installation. Its connection to an outside server is command and control, and the theft of files is the action on the objective.
Defenders map controls to stages. Threat intelligence and hardening address reconnaissance, email filtering addresses delivery, patching addresses exploitation, endpoint protection addresses installation, and egress filtering addresses command and control.
The Diamond Model
The Diamond Model of Intrusion Analysis says that every intrusion event has four core features, shown as the corners of a diamond.
| Feature | Meaning | Example |
|---|---|---|
| Adversary | The actor behind the activity | A named threat group |
| Capability | The tools and techniques used | A remote access tool, an exploit |
| Infrastructure | The systems used to deliver or control the attack | Domains, servers and email addresses |
| Victim | The target | A person, organisation or asset |
The edges show relationships. The adversary uses a capability, over infrastructure, against a victim.
An event also has meta features that add detail. These include the time, the phase of the attack, the result, the direction, the method and the resources used. With them, an analyst can record when something happened and what came of it.
The model supports pivoting. If you know one feature, you can look for related ones. A malicious domain, which is infrastructure, can lead you to other victims that contacted it, or to the capability and the adversary behind it.
Using both models
| Question | Best model |
|---|---|
| At what stage was the attack stopped or seen? | Kill chain |
| Who, with what, using which systems, against whom? | Diamond |
To classify an event, first ask what the attacker did and place it at a kill chain stage. Then fill in the four diamond features that the evidence supports.
For example, a firewall log shows a host beaconing to a rare domain every five minutes. In the kill chain, this is command and control.
In the Diamond Model, the host is the victim, the domain is infrastructure, and the beacon software is the capability. The adversary is not yet known.
What to remember for the exam
Seven facts cover most questions on this topic.
- The kill chain has seven stages, from reconnaissance to actions on objectives.
- The order is reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
- Breaking any link in the chain can stop the attack.
- The Diamond Model has four features: adversary, capability, infrastructure and victim.
- Meta features add detail such as time, phase, result, direction and method.
- Pivoting uses one known feature to find related ones.
- The kill chain gives stages, and the Diamond Model describes each event.
A phishing email is delivery, the code running is exploitation, and the beacon to an outside server is command and control.
Common mistakes
These four errors appear often.
Mixing up delivery and exploitation. Delivery gets the weapon to the target, and exploitation makes it run.
Mixing up installation and command and control. Installation plants the malware, and command and control is the channel back to the attacker.
Forgetting weaponization is out of sight. It happens on the attacker side.
Treating infrastructure as the adversary. A server is a tool the adversary uses.
Real attacks do not always follow the stages in a straight line, and some stages may repeat as the attacker moves through the network.
Check yourself
Work through these three questions.
What are the seven stages of the Cyber Kill Chain?
Reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
What are the four core features of the Diamond Model?
Adversary, capability, infrastructure and victim.
At which kill chain stage is a host beaconing to an outside server?
Command and control.
Topic 7 of 7 in Security Policies and Procedures
Test yourself on Security Policies and Procedures
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.