6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model

6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model

Quick Answer: Blueprint sub-topic 5.2 pairs digital forensics with attack attribution, and it names three models by name. The Cyber Kill Chain describes an intrusion as a sequence of seven phases — it answers "how far did they get?" MITRE ATT&CK catalogues observed adversary behaviour as tactics and techniques — it answers "what exactly did they do, and what else does this actor usually do?" The Diamond Model links adversary, capability, infrastructure, and victim — it answers "what else can I discover by pivoting from what I already know?" Section 6.3 covers the evidence-handling half of sub-topic 5.2; this section covers the attribution half.

These three models are not competitors. Mature analysis uses all three: the Kill Chain for phase and progression, ATT&CK for behavioural detail and detection coverage, and the Diamond Model for relating the elements and driving investigation.

---

1. The Lockheed Martin Cyber Kill Chain

Published by Lockheed Martin in 2011, the Cyber Kill Chain adapts a military targeting concept to intrusions. Its central claim is operationally useful: an intrusion is a chain of dependent steps, so breaking any single link disrupts the entire attack.

Why the sequence matters

Weaponization has no defensive control because it happens on the attacker's infrastructure — a point exam items like to test. The practical implication of the chain is that earlier interception is cheaper: blocking a phishing email at Delivery costs nothing, while responding at Actions on Objectives means the data is already gone.

Known limitations

• It is perimeter- and malware-centric, and models an external intruder well but an insider threat — who starts with legitimate access — poorly.
• It is linear, whereas real intrusions loop: an attacker who lands on one host repeats reconnaissance, exploitation, and installation for each subsequent host.
• It under-represents post-compromise activity, compressing weeks of lateral movement, privilege escalation, and collection into a single final phase. That gap is precisely what MITRE ATT&CK fills.

---

2. MITRE ATT&CK

ATT&CK — Adversarial Tactics, Techniques, and Common Knowledge — is a freely available, continuously updated knowledge base of adversary behaviour observed in real intrusions. It is descriptive rather than prescriptive: it documents what attackers have actually been seen doing.

Structure

• Tactics — the adversary's objective, the why. Each has an ID such as TA0001.
• Techniques — how the objective is achieved, with IDs such as T1566 (Phishing).
• Sub-techniques — specific variants, such as T1566.001 (Spearphishing Attachment).
• Procedures — the concrete implementation a particular group used in a particular intrusion.
• Groups and Software — named adversary groups and the tooling associated with them, mapped to the techniques they use.

ATT&CK is published as separate matrices for Enterprise (Windows, macOS, Linux, cloud, containers, network devices), Mobile, and ICS (industrial control systems).

The 14 Enterprise tactics, in rough operational order

How ATT&CK is used in practice

1. Detection engineering. Alerts are tagged with technique IDs, so the SOC can state which behaviours it can detect — and which it cannot.
2. Coverage mapping. Plotting existing detections onto the matrix exposes blind spots. A SOC strong on Initial Access but blind to Credential Access will find intrusions late.
3. Threat hunting. "This actor typically uses T1003 OS Credential Dumping — do we see evidence of it?" is a far better hunt hypothesis than "look for anything unusual."
4. Incident enrichment. Mapping observed activity to techniques suggests what else to look for, since groups reuse behaviour.
5. Purple teaming. Red teams execute specific techniques; blue teams verify whether each was detected. The result is a measurable coverage score rather than an opinion.

ATT&CK versus the Kill Chain

The Kill Chain gives you seven phases and a sense of progression. ATT&CK gives you hundreds of specific, testable behaviours. Use the Kill Chain to communicate how far an intrusion progressed — including to non-technical stakeholders — and ATT&CK to describe precisely what happened and to drive detection.

---

3. The Diamond Model of Intrusion Analysis

Published in 2013, the Diamond Model takes a different angle. Rather than sequencing an attack, it asserts that every intrusion event has four core features, connected as a diamond:

The two axes carry meaning: adversary → capability → victim is the operational path of the attack, while infrastructure connects the adversary to the victim. Meta-features record timestamp, phase, result, direction, methodology, and analyst confidence.

Pivoting — the model's real value

The core analytic technique is pivoting: knowing one vertex lets you discover the others.

Worked example. You detect a single capability — a malicious document hash on one workstation.

1. Pivot capability → infrastructure: detonate the sample and extract the C2 domain it contacts.
2. Pivot infrastructure → victim: query DNS and proxy logs for every other host in your environment that resolved or contacted that domain. You discover four more infected machines that no alert had fired on.
3. Pivot infrastructure → adversary: check the domain and its hosting against threat intelligence; it matches infrastructure previously reported for a known group.
4. Pivot adversary → capability: that group is also documented using a specific credential-dumping technique, so you hunt for it — and find it on two of the four hosts.

Each pivot expands the picture from a single alert to the true scope of the compromise. This is why the Diamond Model is described as an analysis model rather than a phase model: it drives investigation rather than describing sequence.

Activity threads and combining the models

Diamond events can be chained into an activity thread — a sequence of diamonds ordered by Kill Chain phase. That combination is the standard mature usage: the Kill Chain supplies the phase, ATT&CK supplies the technique detail within the phase, and the Diamond Model relates the elements and drives the pivots.

---

4. Tactics, Techniques, and Procedures

TTPs describe adversary behaviour at three levels of specificity, and the blueprint names them explicitly:

The Pyramid of Pain

David Bianco's Pyramid of Pain explains why TTP-level detection is worth the extra effort. It ranks indicators by how much difficulty the attacker faces if you deny them:

The lesson for a SOC: blocking a hash stops today's sample; detecting the behaviour — such as any process reading LSASS memory — stops the whole class of attack regardless of which tool implements it. This is exactly why ATT&CK is organised around behaviour, and why EDR platforms increasingly alert on behavioural sequences rather than on signatures.

---

5. The Limits of Attribution

The blueprint says attack attribution processes, and part of understanding those processes is knowing how uncertain they are.

What makes confident attribution hard:

• False flags. Sophisticated actors deliberately plant misleading artefacts — foreign-language strings in binaries, timestamps aligned to another country's working hours, tooling borrowed from a different group.
• Shared and commodity tooling. Many groups use the same widely available frameworks and post-exploitation tools, so tooling alone proves little.
• Rented and compromised infrastructure. C2 servers sit on commercial hosting or on hacked legitimate sites, so infrastructure ownership rarely identifies the operator.
• Affiliate models. Ransomware-as-a-service means the group that wrote the malware is frequently not the group that used it.

Practical guidance:

1. Attribution is rarely a Tier 1 task. A technician's job is to accurately record what happened — techniques observed, indicators collected, timeline established. Naming an actor is for senior analysts, threat intelligence teams, and law enforcement, working from far more information than one incident provides.
2. Behavioural attribution beats indicator attribution. A consistent pattern of TTPs across incidents is far more meaningful than a shared IP address.
3. State confidence explicitly. Report "activity consistent with previously reported behaviour of group X, moderate confidence" rather than "group X attacked us." The Diamond Model includes an analyst-confidence meta-feature for exactly this reason.
4. Attribution rarely changes the immediate response. You contain, eradicate, and recover the same way regardless of who is behind it. Attribution informs longer-term posture, intelligence sharing, and any legal or law-enforcement track — it should never delay containment.