3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis

Lockheed Martin Cyber Kill Chain: Theoretical Foundations

Developed in 2011 by Lockheed Martin computer scientists Eric M. Hutchins, Michael J. Cloppert, and Rohan M. Amin, the Cyber Kill Chain adapts classical military targeting doctrine to information security operations. The framework is derived from the military F2T2EA cycle (Find, Fix, Track, Target, Engage, Assess).

The Principle of Asymmetric Defense

Traditional physical security models often favor the attacker: defenders must protect every potential perimeter weakness, while an attacker needs only a single vulnerability to achieve compromise. The Cyber Kill Chain reverses this asymmetry. It posits that an advanced persistent threat (APT) must execute a rigid, sequential chain of operational phases to achieve their ultimate mission. If defenders successfully detect and disrupt the adversary at any single link along the chain, the overall intrusion fails, and the enterprise remains protected.

---

The Seven Sequential Kill Chain Phases in Depth

[Lockheed Martin 7-Phase Cyber Kill Chain]
1. Reconnaissance -> Research, identify, and select targets
2. Weaponization  -> Couple exploit with payload into deliverable weapon
3. Delivery       -> Transmit weapon to victim environment (phishing/web)
4. Exploitation   -> Trigger malicious code via software/human vulnerability
5. Installation   -> Establish persistent foothold (registry, scheduled tasks)
6. Command & Ctrl -> Establish bidirectional interactive communication channel
7. Actions on Obj -> Fulfill mission (data exfiltration, ransomware encryption)

1. Reconnaissance

• Operational Objective: Gathering intelligence to identify organizational weaknesses, system topologies, and personnel profiles.
• Passive Reconnaissance: Collecting publicly available Open Source Intelligence (OSINT) without generating traffic on victim networks. Attackers scrape LinkedIn for employee organizational charts, search GitHub for leaked API keys, query Shodan for exposed server ports, and review WHOIS records and BGP routing prefixes.
• Active Reconnaissance: Probing the victim's infrastructure directly via ICMP network sweeps, TCP SYN port scans, web application directory enumeration (e.g., using Gobuster or Dirbuster), and vulnerability banner grabbing.
• SOC Telemetry: Web server access logs, edge firewall drop logs, NIDS port sweep alerts, and threat intelligence alerts regarding external scans.

2. Weaponization

• Operational Objective: Coupling a software vulnerability exploit with a malicious remote access payload (e.g., a Remote Access Trojan [RAT]) to construct a deliverable cyber weapon.
• Mechanisms: Weaponizing Microsoft Office documents with obfuscated Visual Basic for Applications (VBA) or Excel 4.0 macros, embedding exploits into PDF documents (e.g., font parsing vulnerabilities), crafting malicious Windows shortcut (.lnk) files, or packaging payloads inside virtual disk (.iso / .vhd) container files to bypass Mark-of-the-Web (MOTW) security controls.
• Operational Reality: Weaponization takes place entirely within the adversary's private development environment and infrastructure. Consequently, defenders have zero real-time visibility into this phase. Defense at this stage relies on post-compromise malware reverse engineering and proactive threat intelligence sharing.

3. Delivery

• Operational Objective: Transmitting the weaponized payload into the victim enterprise network.
• Primary Delivery Vectors:
  • Spear-Phishing: Targeted emails delivering malicious attachments or directing recipients to credential harvesting landing pages.
  • Watering Hole Attacks: Compromising a legitimate third-party website frequented by employees in the target sector to serve drive-by download exploits.
  • Public-Facing Exploits: Transmitting exploit packets directly to unpatched edge appliances (e.g., enterprise VPN gateways, external firewalls, web applications).
  • Removable Media: Dropping infected USB flash drives in enterprise parking lots.
• SOC Telemetry: Secure Email Gateway (SEG) inspection logs, proxy logs, Web Application Firewall (WAF) alerts, and external DNS queries.

4. Exploitation

• Operational Objective: Triggering the execution of malicious code on the victim system.
• Mechanisms: Exploiting memory corruption flaws (buffer overflows, heap sprays, use-after-free conditions) in client applications (web browsers, document readers), exploiting server-side remote code execution flaws (e.g., Log4Shell, ProxyLogon), or exploiting human psychology to convince users to enable macro execution.
• SOC Telemetry: Endpoint Detection and Response (EDR) behavioral alerts, Windows Security Event ID 4688 (Process Creation with Command Line), Data Execution Prevention (DEP) crash logs, and Sysmon Event ID 1 (Process Create).

5. Installation

• Operational Objective: Establishing a persistent presence on the compromised endpoint so that access survives operating system reboots, user logoffs, and network disconnects.
• Persistence Mechanisms: Writing executable paths into Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), creating scheduled tasks via schtasks.exe, registering malicious background services (sc.exe create), installing rootkits, dropping web shells into public web server directories, or executing DLL side-loading attacks.
• SOC Telemetry: File Integrity Monitoring (FIM), Sysmon Event ID 11 (File Create), Sysmon Event ID 12/13 (Registry Object Added/Modified), and EDR persistence monitors.

6. Command & Control (C2 / C&C)

• Operational Objective: Establishing a reliable, bidirectional communication channel between the compromised host and adversary-controlled external infrastructure to enable hands-on-keyboard control.
• Mechanisms: Outbound beaconing over standard web protocols (HTTP/HTTPS) to blend in with legitimate web browsing, DNS tunneling (encoding commands inside DNS subdomains to bypass egress filters), WebSocket connections, domain fronting, or leveraging third-party cloud APIs (Slack, Telegram, GitHub) as dead-drop resolvers.
• SOC Telemetry: Network Detection and Response (NDR) beaconing detection, NetFlow/IPFIX volume analysis, DNS query inspection, and TLS JA3/JA3S fingerprinting.

7. Actions on Objectives

• Operational Objective: Fulfilling the ultimate operational intent of the intrusion campaign.
• Attack Outcomes:
  • Data Exfiltration: Compressing, encrypting, and staging confidential customer databases, intellectual property, or source code for exfiltration.
  • Ransomware Extortion: Propagating ransomware (e.g., LockBit, BlackCat) via Active Directory group policies to encrypt critical virtual machines and databases.
  • System Destruction: Executing wiper malware to overwrite Master Boot Records (MBR) and destroy enterprise operational capabilities.
• SOC Telemetry: Data Loss Prevention (DLP) egress alerts, database query volume anomalies, mass file modification alerts, and Active Directory Event ID 4672 (Special Privileges Assigned).

---

The SOC Defensive Action Matrix (The "6 D's")

To operationalize the Kill Chain, defenders apply six distinct defensive capabilities across each of the seven attack phases:

---

The Diamond Model of Intrusion Analysis

While the Cyber Kill Chain models the chronological progression of an intrusion, the Diamond Model of Intrusion Analysis (authored by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz) formalizes the mathematical and relational architecture of malicious activity.

The Atomic Building Block: The Event

In the Diamond Model, every intrusion is decomposed into atomic building blocks called Events. A single event represents an adversary utilizing a specific capability over an infrastructure against a victim at a specific point in time:

$\text{Event } (E) = \langle \text{Adversary}, \text{Capability}, \text{Infrastructure}, \text{Victim} \rangle$

The Four Core Vertices

                  [ADVERSARY]
                  /         \
                 /           \
   [CAPABILITY] ------------- [INFRASTRUCTURE]
                 \           /
                  \         /
                   [VICTIM]

1. Adversary: The threat actor entity directing or executing the malicious activity. The model differentiates between:
   • Adversary Operator: The human individual sitting behind the keyboard executing commands.
   • Adversary Customer: The organization, intelligence agency, or criminal syndicate funding and directing the operation.
2. Capability: The tools, malware, exploits, and technical methodologies utilized by the adversary in the event (e.g., Cobalt Strike, PowerShell loaders, CVE-2023-38831 exploit code).
3. Infrastructure: The physical or logical communication networks and compute hardware used to deliver capabilities and control operations. Delineated into:
   • Type 1 Infrastructure: Hardware, servers, and domains owned, leased, or directly controlled by the adversary.
   • Type 2 Infrastructure: Compromised third-party infrastructure, zombie botnets, commercial VPN relays, or shared cloud microservices.
4. Victim: The target being attacked. Decomposed into:
   • Victim Organization: The enterprise or corporate entity.
   • Victim Persona: The specific human user, corporate role, or email account targeted.
   • Victim Asset: The specific endpoint, server, IP address, or cloud container undergoing exploitation.

The Two Primary Axes

• Social-Political Axis (Adversary $\longleftrightarrow$ Victim): Characterizes the human intent, motivation, and relationship between the adversary and the victim (e.g., geopolitical espionage, economic sabotage, financial extortion, hacktivism).
• Technical Axis (Capability $\longleftrightarrow$ Infrastructure): Characterizes the technical mechanisms connecting the attack tools with the communication infrastructure (e.g., C2 protocol packet encapsulation, beaconing ports, exploit delivery channels).

The Six Core Meta-Features

Every Diamond event is enriched with six analytical meta-features:

1. Timestamp: The start and end time of the event.
2. Phase: The corresponding attack lifecycle stage (e.g., Kill Chain Delivery phase).
3. Result: The operational outcome (Success, Failure, Unknown).
4. Direction: The traffic path across the diamond (Adversary-to-Infrastructure, Infrastructure-to-Victim, Bidirectional).
5. Methodology: The general attack class (e.g., Spear phishing, SQL injection, Kerberoasting).
6. Resources: Prerequisite assets required to sustain the event (e.g., software libraries, specialized hardware).

Activity Threads and Campaign Clustering

• Activity Thread: A sequence of Diamond events linked chronologically that depict an adversary progressing through a single intrusion campaign.
• Activity Groups & Clustering: When analysts discover multiple activity threads sharing identical Type 1 infrastructure (overlapping C2 IP spaces, shared TLS certificates) and shared capabilities (custom malware code reuse, distinct encryption routines), they cluster them into a single attributed threat actor group (e.g., APT29, FIN7).