Incident Handling · Topic 2 of 4
Digital Forensics, Kill Chain, ATT&CK and Evidence Handling
Learn the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model, TTPs, sources of digital evidence and how to preserve evidence and keep a chain of custody.
- 5 min
- Includes a diagram
- The Cyber Kill Chain has seven stages, from reconnaissance to actions on objectives.
- MITRE ATT&CK organises tactics, which are goals, and techniques, which are methods.
- The Diamond Model links adversary, capability, infrastructure and victim.
What it is
Digital forensics is the careful collection and study of digital evidence to find out what happened.
Attack attribution is the effort to work out who was behind an attack, or at least which group's methods it matches. Both rely on models that describe how attacks unfold, and on strict rules for handling evidence.
This page covers three models, the idea of TTPs, the sources of evidence, and how evidence is preserved and tracked.
How it works
Models give analysts a shared language, and evidence rules make the findings trustworthy.
The Cyber Kill Chain
The Cyber Kill Chain describes an attack as seven stages. Breaking the chain at any stage stops the attack, so defenders try to stop it as early as possible.
| Stage | What happens |
|---|---|
| Reconnaissance | The attacker researches the target |
| Weaponization | The attacker builds a malicious payload |
| Delivery | The payload is sent, for example by email or a website |
| Exploitation | A weakness is used to run the code |
| Installation | Malware or a backdoor is installed |
| Command and control | The attacker gets remote control |
| Actions on objectives | The attacker achieves the goal, such as data theft |
MITRE ATT&CK and the Diamond Model
MITRE ATT&CK is a public knowledge base of real attacker behaviour, laid out as a matrix. The columns are tactics, which are the attacker's goals, such as initial access, persistence, privilege escalation, lateral movement and exfiltration. Under each tactic are techniques, which are the ways of reaching that goal.
ATT&CK is used to describe what an attacker did, to check which techniques your defences detect, and to compare incidents.
The Diamond Model describes each intrusion event using four connected points:
- Adversary: who is carrying out the attack
- Capability: the tools and methods used
- Infrastructure: the systems used to deliver or control the attack, such as servers and domains
- Victim: the target
Linking events that share a point, such as the same infrastructure, helps analysts see that separate incidents belong to one campaign.
| Model | Best for |
|---|---|
| Kill Chain | The stages of an attack, in order |
| ATT&CK | Detailed attacker tactics and techniques |
| Diamond Model | Relationships between adversary, capability, infrastructure and victim |
TTPs
TTPs stand for tactics, techniques and procedures. Tactics are the goals, techniques are the general ways of reaching them, and procedures are the exact steps a particular group follows.
TTPs are valuable for attribution because a group's habits are hard to change. Tools and addresses are easy to swap, but the way a group works tends to be consistent. Attribution is still difficult, since attackers can imitate others or hide behind other systems, so it should be treated as a judgement.
Sources of evidence
Evidence from an incident is called an artifact. Common sources are:
- log files from servers, firewalls, proxies and endpoints
- memory contents of a running machine
- disk images and files, including deleted ones
- network traffic captures
- email messages and their headers
- user accounts, and records of logins
Evidence disappears at different speeds. Memory is volatile, which means it is lost when power is lost, so it should be captured before a machine is turned off. Data on disk lasts much longer.
Preserving evidence and chain of custody
If evidence may be used in a legal or disciplinary case, it must be handled so that nobody can claim it was changed.
- Work on a copy, such as a forensic image, and leave the original untouched
- Use a hash value to prove that the copy matches the original and has not changed
- Use tools, such as write blockers, that stop the original disk from being altered
- Record every action, with the time and the person
Chain of custody is the written record of who handled the evidence, when, where, and why, from collection to presentation. Each transfer is signed. Evidence is stored securely, with limited access.
A gap in the chain of custody can make evidence unusable.
What to remember for the exam
Seven facts cover most questions on this topic.
- The Cyber Kill Chain has seven stages, from reconnaissance to actions on objectives.
- MITRE ATT&CK organises tactics, which are goals, and techniques, which are methods.
- The Diamond Model links adversary, capability, infrastructure and victim.
- TTPs are tactics, techniques and procedures, and they help with attribution.
- Memory is volatile, so capture it before powering a machine off.
- Work on a copy and use hashes to prove the evidence is unchanged.
- Chain of custody records who handled evidence, when and why.
The Kill Chain is an ordered list of stages, ATT&CK is a matrix of behaviours, and the Diamond Model is four linked points.
Common mistakes
These four errors are common.
Working on the original evidence. Any change can make the evidence worthless, so analyse a copy.
Switching off a machine first. This destroys volatile data in memory.
Treating attribution as certain. Attackers can copy methods, so attribution is a judgement.
Leaving gaps in the chain of custody. An unrecorded transfer can make evidence unusable.
Do not start digging around on a compromised machine before deciding how to preserve evidence. Careless actions overwrite traces.
Check yourself
Work through these three questions.
What are the four points of the Diamond Model?
Adversary, capability, infrastructure and victim.
Why capture memory before powering off a machine?
Memory is volatile, so its contents are lost when power is lost.
What is the chain of custody?
It is the written record of who handled the evidence, when, where and why, from collection onwards.
Topic 2 of 4 in Incident Handling
Test yourself on Incident Handling
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.