Study guide
6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
Cisco CCST Cybersecurity Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Introduction & Exam Strategy
1.1 About the Cisco CCST Cybersecurity Exam 1.2 Study Roadmap & Preparation Strategy
2 Chapter 2: Essential Security Principles
2.1 Information Security Principles & The CIA Triad 2.2 Confidentiality, Integrity & Availability Controls 2.3 Authentication, Authorization & Accounting (AAA) 2.4 Social Engineering & Human Vulnerabilities 2.5 Security Principles & Access Management 2.6 Encryption, Hashing, Certificates & PKI
3 Chapter 3: Basic Network Security Concepts
3.1 Network Architecture & The OSI/TCP-IP Models 3.2 Network Defense Infrastructure & Firewalls 3.3 Intrusion Detection & Prevention Systems (IDS/IPS) 3.4 Virtual Private Networks & Encryption Protocols 3.5 Network Segmentation, DMZ & Access Control Lists 3.6 Secure Network Protocols & Services
4 Chapter 4: Endpoint Security Concepts
4.1 Endpoint Protection & Host-Based Defense 4.2 Operating System Hardening & Security Baselines 4.3 Patch Management & Vulnerability Remediation 4.4 Mobile Device Management (MDM) & BYOD Security 4.5 Endpoint Detection & Response (EDR) & Compliance 4.6 Endpoint Assessment Tools & Malware Removal
5 Chapter 5: Vulnerability Assessment & Risk Management
5.1 Risk Assessment & Risk Management 5.2 Vulnerability Scanning & Penetration Testing 5.3 CVSS Scoring & Threat Intelligence 5.4 Business Continuity & Disaster Recovery
6 Chapter 6: Incident Handling & Response
6.1 NIST Incident Response Lifecycle & Frameworks 6.2 Incident Containment, Eradication, & System Recovery 6.3 Digital Forensics Fundamentals & Evidence Preservation 6.4 Post-Incident Activity & Compliance Reporting 6.5 SOC Operations, Log Triage, & Event Monitoring 6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
Key Takeaways Explain This Topic AI
The Lockheed Martin Cyber Kill Chain models an intrusion as seven sequential phases from Reconnaissance to Actions on Objectives, and breaking any single phase disrupts the whole attack.
MITRE ATT&CK is a knowledge base of observed adversary behavior organized as 14 Enterprise tactics (the why) containing techniques and sub-techniques (the how).
The Diamond Model links four core features — adversary, capability, infrastructure, and victim — so an analyst can pivot from one known element to discover the others.
TTPs describe strategy, method, and specific implementation; the Pyramid of Pain shows that blocking TTPs costs an attacker far more than blocking a hash or IP address.
Attribution to a named actor is rarely a Tier 1 responsibility, because false flags, shared tooling, and rented infrastructure make confident naming difficult.
Last updated: August 2026
6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
Quick Answer: Blueprint sub-topic 5.2 pairs digital forensics with attack attribution , and it names three models by name. The Cyber Kill Chain describes an intrusion as a sequence of seven phases — it answers "how far did they get?" MITRE ATT&CK catalogues observed adversary behaviour as tactics and techniques — it answers "what exactly did they do, and what else does this actor usually do?" The Diamond Model links adversary, capability, infrastructure, and victim — it answers "what else can I discover by pivoting from what I already know?" Section 6.3 covers the evidence-handling half of sub-topic 5.2; this section covers the attribution half.
These three models are not competitors. Mature analysis uses all three: the Kill Chain for phase and progression, ATT&CK for behavioural detail and detection coverage, and the Diamond Model for relating the elements and driving investigation.
1. The Lockheed Martin Cyber Kill Chain
Published by Lockheed Martin in 2011, the Cyber Kill Chain adapts a military targeting concept to intrusions. Its central claim is operationally useful: an intrusion is a chain of dependent steps , so breaking any single link disrupts the entire attack .
# Phase What the attacker does Representative defensive control
1 Reconnaissance Researches the target: harvests employee names and email formats from LinkedIn, enumerates public DNS records, scans internet-facing hosts Reduce public attack surface; monitor for scanning; awareness training on what staff publish
2 Weaponization Couples an exploit with a payload — for example, embedding a macro dropper in a document Not observable by the defender; this occurs entirely on the attacker's own systems
3 Delivery Transmits the weapon: phishing email, malicious link, watering-hole site, USB drop, exploit against an exposed service Email filtering and attachment sandboxing; web proxy; disabling unused external services
4 Exploitation Triggers the vulnerability — the macro runs, the browser flaw fires, the credential is accepted Patching; application allow-listing; disabling macros from the internet; endpoint exploit protection
5 Installation Establishes persistence: a service, a Run key, a scheduled task, a web shell EDR behavioural detection; application control; monitoring autostart locations
6 Command & Control (C2) Opens a channel to attacker infrastructure for remote direction Egress filtering; DNS monitoring and sinkholing; proxy inspection; blocking known C2 destinations
7 Actions on Objectives Achieves the goal: data exfiltration, encryption for ransom, lateral movement to a higher-value target, destruction DLP; segmentation to constrain lateral movement; immutable backups; anomaly detection on outbound volume
Why the sequence matters
Weaponization has no defensive control because it happens on the attacker's infrastructure — a point exam items like to test. The practical implication of the chain is that earlier interception is cheaper : blocking a phishing email at Delivery costs nothing, while responding at Actions on Objectives means the data is already gone.
Known limitations
It is perimeter- and malware-centric , and models an external intruder well but an insider threat — who starts with legitimate access — poorly.
It is linear , whereas real intrusions loop: an attacker who lands on one host repeats reconnaissance, exploitation, and installation for each subsequent host.
It under-represents post-compromise activity , compressing weeks of lateral movement, privilege escalation, and collection into a single final phase. That gap is precisely what MITRE ATT&CK fills.
2. MITRE ATT&CK
ATT&CK — Adversarial Tactics, Techniques, and Common Knowledge — is a freely available, continuously updated knowledge base of adversary behaviour observed in real intrusions . It is descriptive rather than prescriptive: it documents what attackers have actually been seen doing.
Structure
Tactics — the adversary's objective , the why . Each has an ID such as TA0001 .
Techniques — how the objective is achieved, with IDs such as T1566 (Phishing).
Sub-techniques — specific variants, such as T1566.001 (Spearphishing Attachment).
Procedures — the concrete implementation a particular group used in a particular intrusion.
Groups and Software — named adversary groups and the tooling associated with them, mapped to the techniques they use.
ATT&CK is published as separate matrices for Enterprise (Windows, macOS, Linux, cloud, containers, network devices), Mobile , and ICS (industrial control systems).
The 14 Enterprise tactics, in rough operational order
- Tactic Adversary objective
- Reconnaissance Gather information to plan the operation
- Resource Development Establish infrastructure and capabilities (domains, accounts, malware)
- Initial Access Get into the network
- Execution Run malicious code
- Persistence Maintain the foothold across reboots and credential changes
- Privilege Escalation Obtain higher-level permissions
- Defense Evasion Avoid detection
- Credential Access Steal account names and passwords
- Discovery Learn the environment from the inside
- Lateral Movement Move to other systems
- Collection Gather the data of interest
- Command and Control Communicate with compromised systems
- Exfiltration Steal the data out
- Impact Manipulate, interrupt, or destroy systems and data
- How ATT&CK is used in practice
Detection engineering. Alerts are tagged with technique IDs, so the SOC can state which behaviours it can detect — and which it cannot.
Coverage mapping. Plotting existing detections onto the matrix exposes blind spots. A SOC strong on Initial Access but blind to Credential Access will find intrusions late.
Threat hunting. "This actor typically uses T1003 OS Credential Dumping — do we see evidence of it?" is a far better hunt hypothesis than "look for anything unusual."
Incident enrichment. Mapping observed activity to techniques suggests what else to look for, since groups reuse behaviour.
Purple teaming. Red teams execute specific techniques; blue teams verify whether each was detected. The result is a measurable coverage score rather than an opinion.
ATT&CK versus the Kill Chain
The Kill Chain gives you seven phases and a sense of progression . ATT&CK gives you hundreds of specific, testable behaviours . Use the Kill Chain to communicate how far an intrusion progressed — including to non-technical stakeholders — and ATT&CK to describe precisely what happened and to drive detection.
3. The Diamond Model of Intrusion Analysis
Published in 2013, the Diamond Model takes a different angle. Rather than sequencing an attack, it asserts that every intrusion event has four core features , connected as a diamond:
- Vertex Definition Example
- Adversary The actor or organisation behind the intrusion A ransomware affiliate group
- Capability The tools, malware, exploits, and skills used A loader delivered by macro, plus a credential dumper
Infrastructure The physical or logical resources used to deliver capability and maintain control C2 domains, VPS hosts, compromised legitimate sites, sender addresses
Victim The target — organisation, person, asset, or network The finance department's file server
The two axes carry meaning: adversary → capability → victim is the operational path of the attack, while infrastructure connects the adversary to the victim. Meta-features record timestamp, phase, result, direction, methodology, and analyst confidence.
Pivoting — the model's real value
The core analytic technique is pivoting : knowing one vertex lets you discover the others.
Worked example. You detect a single capability — a malicious document hash on one workstation.
Pivot capability → infrastructure : detonate the sample and extract the C2 domain it contacts.
Pivot infrastructure → victim : query DNS and proxy logs for every other host in your environment that resolved or contacted that domain. You discover four more infected machines that no alert had fired on.
Pivot infrastructure → adversary : check the domain and its hosting against threat intelligence; it matches infrastructure previously reported for a known group.
Pivot adversary → capability : that group is also documented using a specific credential-dumping technique, so you hunt for it — and find it on two of the four hosts.
Each pivot expands the picture from a single alert to the true scope of the compromise. This is why the Diamond Model is described as an analysis model rather than a phase model: it drives investigation rather than describing sequence.
Activity threads and combining the models
Diamond events can be chained into an activity thread — a sequence of diamonds ordered by Kill Chain phase. That combination is the standard mature usage: the Kill Chain supplies the phase, ATT&CK supplies the technique detail within the phase, and the Diamond Model relates the elements and drives the pivots.
4. Tactics, Techniques, and Procedures
TTPs describe adversary behaviour at three levels of specificity, and the blueprint names them explicitly:
- Level Meaning Example
- Tactic The high-level objective — the why Credential Access
- Technique The general method — the how OS credential dumping
Procedure The specific implementation this actor used — the exact what Running a particular tool with a specific flag set to dump LSASS memory to a named file in C:\Windows\Temp
The Pyramid of Pain
David Bianco's Pyramid of Pain explains why TTP-level detection is worth the extra effort. It ranks indicators by how much difficulty the attacker faces if you deny them:
- Level (bottom to top) Indicator Cost to the attacker if blocked
- 1 Hash values Trivial — recompile or change one byte
- 2 IP addresses Easy — rent another host
- 3 Domain names Simple — register a new domain
- 4 Network / host artifacts Annoying — modify tooling behaviour
- 5 Tools Challenging — find, buy, or build a replacement
- 6 TTPs Tough — requires changing how they operate, and retraining
The lesson for a SOC: blocking a hash stops today's sample; detecting the behaviour — such as any process reading LSASS memory — stops the whole class of attack regardless of which tool implements it. This is exactly why ATT&CK is organised around behaviour, and why EDR platforms increasingly alert on behavioural sequences rather than on signatures.
5. The Limits of Attribution
The blueprint says attack attribution processes , and part of understanding those processes is knowing how uncertain they are.
What makes confident attribution hard:
False flags. Sophisticated actors deliberately plant misleading artefacts — foreign-language strings in binaries, timestamps aligned to another country's working hours, tooling borrowed from a different group.
Shared and commodity tooling. Many groups use the same widely available frameworks and post-exploitation tools, so tooling alone proves little.
Rented and compromised infrastructure. C2 servers sit on commercial hosting or on hacked legitimate sites, so infrastructure ownership rarely identifies the operator.
Affiliate models. Ransomware-as-a-service means the group that wrote the malware is frequently not the group that used it.
Practical guidance:
Attribution is rarely a Tier 1 task. A technician's job is to accurately record what happened — techniques observed, indicators collected, timeline established. Naming an actor is for senior analysts, threat intelligence teams, and law enforcement, working from far more information than one incident provides.
Behavioural attribution beats indicator attribution. A consistent pattern of TTPs across incidents is far more meaningful than a shared IP address.
State confidence explicitly. Report "activity consistent with previously reported behaviour of group X, moderate confidence" rather than "group X attacked us." The Diamond Model includes an analyst-confidence meta-feature for exactly this reason.
Attribution rarely changes the immediate response. You contain, eradicate, and recover the same way regardless of who is behind it. Attribution informs longer-term posture, intelligence sharing, and any legal or law-enforcement track — it should never delay containment.