CySA+
3.1Incident Response and Management · 24% of exam

Summarize concepts related to attack methodology frameworks

Cyber Kill Chain, Diamond Model, MITRE ATT&CK, and OSSTMM — mapping observed activity onto a model to predict what comes next.

Reading time
24 min read
Flashcards
15 cards
Practice questions
8 questions · 2 PBQs

A framework's value to an analyst is prediction. You have three observations; the framework tells you what usually comes before and after them, so you know where to look next and how urgent this is.

Four frameworks, and they are not competing answers to the same question. Knowing which one a stem is asking about is most of the marks.

Cyber Kill Chain

Lockheed Martin's seven-stage model of an intrusion, in sequence:

  1. Reconnaissance — researching the target
  2. Weaponisation — pairing an exploit with a payload
  3. Delivery — getting it to the victim (email, web, USB)
  4. Exploitation — the vulnerability is triggered
  5. Installation — persistence established
  6. Command and control — the implant calls home
  7. Actions on objectives — what they actually came for

Breaking the chain

The model's central claim: the defender only has to break one link. Blocking delivery, preventing exploitation, or severing C2 all stop the intrusion — which is why layered defence works even though no single layer is perfect.

MITRE ATT&CK

ATT&CK

A knowledge base of real adversary behaviour, organised as tactics (the goal — why) and techniques (the method — how), with documented procedures showing how specific groups implement them. It is a matrix rather than a sequence, because real adversaries do not proceed in order.

The distinction the exam wants: a tactic is the objective, a technique is how it is achieved. Persistence is a tactic; a scheduled task is a technique that achieves it. Credential access is a tactic; dumping LSASS is a technique.

Kill Chain

  • Seven linear stages
  • Answers: how far has this progressed?
  • Good for explaining an intrusion to management
  • Assumes an external attacker, in order

ATT&CK

  • Matrix of tactics and techniques
  • Answers: exactly what did they do, and what else might they do?
  • Good for building and measuring detections
  • Describes behaviour observed in the wild

The tellIf the stem is about detection coverage, technique names, or mapping observed behaviour, it is ATT&CK. If it is about how far an intrusion progressed, it is the Kill Chain.

ATT&CK's practical use is coverage mapping: list the techniques a relevant actor uses, check which you can detect, and the gaps become your detection roadmap. That turns "are we secure" into a question with an actual answer.

Check yourself

An analyst wants to determine which adversary behaviours the SOC currently has no detection for. Which framework is designed for this?

The Diamond Model

Four vertices describing a single intrusion event: adversary, capability, infrastructure, victim. The adversary uses a capability over some infrastructure against a victim.

Its power is pivoting. Knowing one vertex leads you to others: a malicious domain (infrastructure) leads to other victims who contacted it, which leads to the capability deployed against them, which may lead back to the adversary. Analysts use it to expand the scope of an investigation from a single indicator.

OSSTMM and the testing guides

OSSTMM

The Open Source Security Testing Methodology Manual — a methodology for conducting security tests, emphasising measurable, repeatable results. It is about how to test, not about how adversaries behave, which is the distinction the exam draws.

The OWASP Web Security Testing Guide plays the same role for web applications: a structured methodology for what to test and how. Both answer "how do I conduct an assessment", where the Kill Chain, ATT&CK and Diamond Model answer "what is the adversary doing".

Check yourself

An intrusion begins with an attacker logging in using valid credentials purchased from a broker. Which criticism of the Cyber Kill Chain does this illustrate?

Using a framework during an investigation

The practical sequence, and it is worth internalising as a habit:

  1. Map what you have observed onto techniques or stages
  2. Look at what normally precedes them — that tells you how they got in, and how much you have missed
  3. Look at what normally follows — that tells you what to hunt for next and how urgent this is
  4. Record the mapping so scope, briefing and lessons learned all draw on the same picture