Incident Response and Management · Topic 2 of 6
Kill Chain and Diamond Model
Compare the Cyber Kill Chain stages and the Diamond Model of Intrusion Analysis with MITRE ATT&CK, and learn when an analyst uses each model for CySA+.
- 5 min
- Includes a diagram
- The Cyber Kill Chain has seven stages, from Reconnaissance to Actions on Objectives.
- Breaking the chain at any stage stops the attack, and earlier is cheaper.
- Weaponization and Delivery come before Exploitation, and Installation comes before Command and Control.
What it is
An attack methodology framework is a structured way to think about an intrusion. Two classic models complement MITRE ATT&CK: the Cyber Kill Chain, which describes the stages of an attack in order, and the Diamond Model, which describes the relationships inside a single intrusion event.
Neither model is a product or a standard that you comply with. They are thinking tools that help an analyst ask the right question at the right time.
How it works
The Cyber Kill Chain
Lockheed Martin adapted the military idea of a "kill chain" to intrusions. It has seven stages, and the key idea is that stopping the attacker at any stage breaks the chain.
| Stage | What happens | Example defensive view |
|---|---|---|
| Reconnaissance | Attacker gathers information about the target | Watch for scanning and probing of public sites |
| Weaponization | Attacker pairs a flaw with a delivery payload | Hard to see, so intelligence helps |
| Delivery | The payload reaches the target | Email filtering, web filtering |
| Exploitation | The flaw is triggered | Patching, exploit protection |
| Installation | Malware is placed to persist | Endpoint detection, application control |
| Command and control (C2) | Attacker gets remote control | Block known destinations, detect beaconing |
| Actions on objectives | Theft, damage or other goal | Data loss prevention, backups, monitoring |
The "earlier is better" rule matters. Disrupting an attack at delivery costs far less than cleaning up after actions on objectives.
The model also pairs each stage with defender actions: detect, deny, disrupt, degrade, deceive and destroy. Together they form a course of action matrix that helps plan layered defences.
Limits: the model is linear and focuses on getting in, so it fits poorly with insider threats, stolen credentials or attacks that loop back to earlier steps. It also says little about what happens inside the network after the first foothold, where ATT&CK is more detailed.
The Diamond Model of Intrusion Analysis
The Diamond Model describes each intrusion event as a diamond with four core features joined by relationships.
| Feature | Meaning | Example |
|---|---|---|
| Adversary | The actor or group behind the event | A criminal group or a state backed team |
| Capability | The tools, malware and techniques used | A phishing kit, a remote access trojan |
| Infrastructure | The systems used to deliver or control the attack | Domains, servers, email accounts |
| Victim | The target | An organisation, a user, a device |
Each event also records meta features that add detail, such as the time, the phase of the attack, the result, the direction (for example, from adversary to victim), the method and the resources used.
The model is useful for pivoting. Starting from one known feature, the analyst searches for others.
A malicious domain (infrastructure) leads to other victims who contacted it, and to malware (capability) that used it. Those can then point to an adversary group.
Individual events are chained into activity threads, which show the order of events in one attack. Several threads can be grouped into activity groups to track a campaign. The model also includes two broader axes: the social and political axis, which links adversary and victim by motive and need, and the technology axis, which links capability and infrastructure.
Comparing the three models
| Model | Shape | Best used for |
|---|---|---|
| Cyber Kill Chain | Seven ordered stages | Planning layered defence and explaining where an attack was stopped |
| MITRE ATT&CK | Detailed matrix of tactics and techniques | Mapping behaviour, finding detection gaps, hunting |
| Diamond Model | Four linked features per event | Attributing events and pivoting between clues |
They work together. For example, a phishing email maps to the Delivery stage, to the Initial Access tactic in ATT&CK, and to infrastructure and capability in the Diamond Model.
When a question lists stages in order and asks where a defender stopped an attack, count along the kill chain. When it names adversary, capability, infrastructure and victim, the answer is the Diamond Model.
What to remember for the exam
- The Cyber Kill Chain has seven stages, from Reconnaissance to Actions on Objectives.
- Breaking the chain at any stage stops the attack, and earlier is cheaper.
- Weaponization and Delivery come before Exploitation, and Installation comes before Command and Control.
- The kill chain's defender actions are detect, deny, disrupt, degrade, deceive and destroy.
- The Diamond Model's core features are adversary, capability, infrastructure and victim.
- Meta features add time, phase, result, direction, methodology and resources.
- Pivoting uses one known feature to find related ones.
- ATT&CK gives more technique detail than the kill chain does.
- The kill chain is linear, so it handles insiders and looping attacks poorly.
Common mistakes
Mixing up the order of stages. Installation (persistence) comes after Exploitation, and Command and Control comes after Installation.
Thinking the kill chain covers everything after a breach. It ends with Actions on Objectives and says little about movement inside a network.
Treating the Diamond Model as a timeline. It describes one event, and activity threads are what order events.
Confusing infrastructure and capability. Capability is the tool or technique, and infrastructure is the system that carries or controls it.
Assuming one model is the correct one. Analysts combine models depending on the question.
Check yourself
Which Cyber Kill Chain stage comes right after Exploitation?
Installation, where the attacker places malware or access to persist.
What are the four core features of the Diamond Model?
Adversary, capability, infrastructure and victim.
Why do defenders try to stop an attack early in the kill chain?
Breaking the chain at an early stage prevents later stages and costs less than recovering from the final goal.
Topic 2 of 6 in Incident Response and Management
Test yourself on Incident Response and Management
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.