Study guide
3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis
EC-Council Certified SOC Analyst CSA 312-39
Track your progress as you read
Finished sections get a check mark.
1 Introduction: Current Exam Facts and Blueprint
0.1 Current Exam Facts, Blueprint, and Study Plan
2 Chapter 1: Security Operations and Management Fundamentals
1.1 SOC Overview, Capabilities, and Operational Workflow 1.2 SOC Architectures, Sourcing Models, and Organizational Components 1.3 SOC Maturity, Generations, Metrics, and KPIs
3 Chapter 2: Cyber Threat Vectors, TTPs, and Attack Techniques
2.1 Network, Host, and Password Attack Techniques 2.2 Application, Web, and Session Attack Vectors 2.3 Social Engineering, Email Threats, and Insider Attacks
4 Chapter 3: Threat Frameworks, Methodologies, and Indicators
3.1 Indicators of Compromise (IoCs), Indicators of Attack (IoAs), and Pyramid of Pain 3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis 3.3 MITRE ATT&CK and MITRE D3FEND Frameworks for SOC Defense
5 Chapter 4: Log Management, Formats, and Centralized Architecture
4.1 Log Fundamentals, Sources, and Host Logging 4.2 Network Device, Web Server, and Database Logs 4.3 Centralized Logging Architectures and Pipeline 4.4 Log Parsing, Normalization, and Field Extraction
6 Chapter 5: SIEM Architecture, Deployment, and Use Case Engineering
5.1 SIEM Architecture, Components, and Deployment Models 5.2 SIEM Use Case Development Lifecycle 5.3 Detection Rule Engineering and Sigma Rules
7 Chapter 6: SIEM Alert Triage, Detection Scenarios, and SOC Operations
6.1 Host and Application-Level Incident Detection Use Cases 6.2 Network-Level and Behavioral Anomaly Detection Use Cases 6.3 Alert Triage Methodology and False Positive Elimination 6.4 SOC Dashboards, Visualizations, and Reporting
8 Chapter 7: Cyber Threat Intelligence (CTI) and Threat-Informed Defense
7.1 Cyber Threat Intelligence (CTI) Lifecycle and Intelligence Types 7.2 Threat Intelligence Sources, Formats, and Platforms 7.3 Integrating Threat Intelligence into SOC and SIEM Operations
9 Chapter 8: Threat Hunting Methodologies and Proactive Detection
8.1 Threat Hunting Principles, Frameworks, and Process 8.2 Threat Hunting Techniques with PowerShell and Scripting 8.3 YARA Rule Crafting and Threat Hunting Tooling
10 Chapter 9: Incident Response Lifecycle, Governance, and Handling Procedures
9.1 Incident Response Frameworks and the SOC-IRT Interface 9.2 Incident Triage, Ticketing, and Prioritization 9.3 Containment, Eradication, Recovery, and Root Cause Analysis
11 Chapter 10: Incident Response Playbooks and SOC Automation
10.1 Specialized Incident Response Playbooks 10.2 Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) 10.3 Security Orchestration, Automation, and Response (SOAR) Playbooks
12 Chapter 11: Digital Forensics and Evidence Handling for SOC Analysts
11.1 Digital Forensics Fundamentals and Evidence Preservation 11.2 Host, Network, and Memory Forensics Triage 11.3 Malware Analysis Techniques for SOC Responders
13 Chapter 12: Cloud SOC Architectures and Monitoring
12.1 Cloud SOC Foundations and Shared Responsibility 12.2 Azure Security Operations with Microsoft Sentinel 12.3 AWS and Google Cloud Platform SOC Architectures
3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis
Key Takeaways Explain This Topic AI
Lockheed Martin's Cyber Kill Chain establishes a seven-phase sequential model of cyber intrusions; breaking any single link halts the adversary's progress and thwarts the attack.
The six defensive actions of the Kill Chain matrix are: Detect, Deny, Disrupt, Degrade, Deceive, and Destroy.
The Diamond Model of Intrusion Analysis formalizes an intrusion event around four core vertices: Adversary, Capability, Infrastructure, and Victim.
The Diamond Model is structured across two primary operational axes—the Social-Political Axis and the Technical Axis—and is enriched by six core meta-features.
Correlating sequential Diamond events into Activity Threads and Activity Groups allows SOC analysts to track adversary campaigns across time and uncover shared infrastructure.
Last updated: September 2026
Lockheed Martin Cyber Kill Chain: Theoretical Foundations
Developed in 2011 by Lockheed Martin computer scientists Eric M. Hutchins, Michael J. Cloppert, and Rohan M. Amin, the Cyber Kill Chain adapts classical military targeting doctrine to information security operations. The framework is derived from the military F2T2EA cycle (Find, Fix, Track, Target, Engage, Assess).
The Principle of Asymmetric Defense
Traditional physical security models often favor the attacker: defenders must protect every potential perimeter weakness, while an attacker needs only a single vulnerability to achieve compromise. The Cyber Kill Chain reverses this asymmetry. It posits that an advanced persistent threat (APT) must execute a rigid, sequential chain of operational phases to achieve their ultimate mission. If defenders successfully detect and disrupt the adversary at any single link along the chain, the overall intrusion fails, and the enterprise remains protected.
- The Seven Sequential Kill Chain Phases in Depth [Lockheed Martin 7-Phase Cyber Kill Chain]
- 1. Reconnaissance -> Research, identify, and select targets
- 2. Weaponization -> Couple exploit with payload into deliverable weapon
- 3. Delivery -> Transmit weapon to victim environment (phishing/web)
- 4. Exploitation -> Trigger malicious code via software/human vulnerability
- 5. Installation -> Establish persistent foothold (registry, scheduled tasks)
- 6. Command & Ctrl -> Establish bidirectional interactive communication channel
- 7. Actions on Obj -> Fulfill mission (data exfiltration, ransomware encryption)
- 1. Reconnaissance
Operational Objective : Gathering intelligence to identify organizational weaknesses, system topologies, and personnel profiles.
Passive Reconnaissance : Collecting publicly available Open Source Intelligence (OSINT) without generating traffic on victim networks. Attackers scrape LinkedIn for employee organizational charts, search GitHub for leaked API keys, query Shodan for exposed server ports, and review WHOIS records and BGP routing prefixes.
Active Reconnaissance : Probing the victim's infrastructure directly via ICMP network sweeps, TCP SYN port scans, web application directory enumeration (e.g., using Gobuster or Dirbuster), and vulnerability banner grabbing.
SOC Telemetry : Web server access logs, edge firewall drop logs, NIDS port sweep alerts, and threat intelligence alerts regarding external scans.
2. Weaponization
Operational Objective : Coupling a software vulnerability exploit with a malicious remote access payload (e.g., a Remote Access Trojan [RAT]) to construct a deliverable cyber weapon.
Mechanisms : Weaponizing Microsoft Office documents with obfuscated Visual Basic for Applications (VBA) or Excel 4.0 macros, embedding exploits into PDF documents (e.g., font parsing vulnerabilities), crafting malicious Windows shortcut ( .lnk ) files, or packaging payloads inside virtual disk ( .iso / .vhd ) container files to bypass Mark-of-the-Web (MOTW) security controls.
Operational Reality : Weaponization takes place entirely within the adversary's private development environment and infrastructure. Consequently, defenders have zero real-time visibility into this phase. Defense at this stage relies on post-compromise malware reverse engineering and proactive threat intelligence sharing.
3. Delivery
Operational Objective : Transmitting the weaponized payload into the victim enterprise network.
Primary Delivery Vectors :
Spear-Phishing : Targeted emails delivering malicious attachments or directing recipients to credential harvesting landing pages.
Watering Hole Attacks : Compromising a legitimate third-party website frequented by employees in the target sector to serve drive-by download exploits.
Public-Facing Exploits : Transmitting exploit packets directly to unpatched edge appliances (e.g., enterprise VPN gateways, external firewalls, web applications).
Removable Media : Dropping infected USB flash drives in enterprise parking lots.
SOC Telemetry : Secure Email Gateway (SEG) inspection logs, proxy logs, Web Application Firewall (WAF) alerts, and external DNS queries.
4. Exploitation
Operational Objective : Triggering the execution of malicious code on the victim system.
Mechanisms : Exploiting memory corruption flaws (buffer overflows, heap sprays, use-after-free conditions) in client applications (web browsers, document readers), exploiting server-side remote code execution flaws (e.g., Log4Shell, ProxyLogon), or exploiting human psychology to convince users to enable macro execution.
SOC Telemetry : Endpoint Detection and Response (EDR) behavioral alerts, Windows Security Event ID 4688 (Process Creation with Command Line), Data Execution Prevention (DEP) crash logs, and Sysmon Event ID 1 (Process Create).
5. Installation
Operational Objective : Establishing a persistent presence on the compromised endpoint so that access survives operating system reboots, user logoffs, and network disconnects.
Persistence Mechanisms : Writing executable paths into Windows Registry Run keys ( HKCU\Software\Microsoft\Windows\CurrentVersion\Run ), creating scheduled tasks via schtasks.exe , registering malicious background services ( sc.exe create ), installing rootkits, dropping web shells into public web server directories, or executing DLL side-loading attacks.
SOC Telemetry : File Integrity Monitoring (FIM), Sysmon Event ID 11 (File Create), Sysmon Event ID 12/13 (Registry Object Added/Modified), and EDR persistence monitors.
6. Command & Control (C2 / C&C)
Operational Objective : Establishing a reliable, bidirectional communication channel between the compromised host and adversary-controlled external infrastructure to enable hands-on-keyboard control.
Mechanisms : Outbound beaconing over standard web protocols (HTTP/HTTPS) to blend in with legitimate web browsing, DNS tunneling (encoding commands inside DNS subdomains to bypass egress filters), WebSocket connections, domain fronting, or leveraging third-party cloud APIs (Slack, Telegram, GitHub) as dead-drop resolvers.
SOC Telemetry : Network Detection and Response (NDR) beaconing detection, NetFlow/IPFIX volume analysis, DNS query inspection, and TLS JA3/JA3S fingerprinting.
7. Actions on Objectives
Operational Objective : Fulfilling the ultimate operational intent of the intrusion campaign.
Attack Outcomes :
Data Exfiltration : Compressing, encrypting, and staging confidential customer databases, intellectual property, or source code for exfiltration.
Ransomware Extortion : Propagating ransomware (e.g., LockBit, BlackCat) via Active Directory group policies to encrypt critical virtual machines and databases.
System Destruction : Executing wiper malware to overwrite Master Boot Records (MBR) and destroy enterprise operational capabilities.
SOC Telemetry : Data Loss Prevention (DLP) egress alerts, database query volume anomalies, mass file modification alerts, and Active Directory Event ID 4672 (Special Privileges Assigned).
The SOC Defensive Action Matrix (The "6 D's")
To operationalize the Kill Chain, defenders apply six distinct defensive capabilities across each of the seven attack phases:
Kill Chain Phase Detect Deny Disrupt Degrade Deceive Destroy
1. Reconnaissance Web access log analysis NIDS port-scan drops Rate limiting edge requests Honeypot redirection Bogus DNS records / fake services Legal takedown of scanning nodes
2. Weaponization CTI threat feed analysis N/A (Adversary Infrastructure) N/A (Adversary Infrastructure) N/A (Adversary Infrastructure) Canary documents in OSINT Takedown of payload builder server
3. Delivery Email gateway inspection Mail filtering / WAF drops Sandbox quarantining Bandwidth throttling Redirection to fake inbox Blacklisting origin MTA IP
4. Exploitation EDR behavioral monitoring Data Execution Prevention (DEP) Host network isolation Memory sandboxing Canary memory buffers Termination of rogue process
5. Installation File Integrity Monitoring (FIM) Application Whitelisting (AppLocker) Antivirus file deletion Limiting local admin privileges Honey-token registry run keys Automated endpoint re-imaging
6. Command & Control NDR beaconing detection Egress firewall port blocks DNS sinkholing QoS packet delay / throttling Honey-C2 responder C2 domain registrar seizure
7. Actions on Obj. DLP exfiltration alerts Read-only storage controls Session termination Outbound bandwidth caps Decoy database honeypots Revocation of compromised tokens
The Diamond Model of Intrusion Analysis
While the Cyber Kill Chain models the chronological progression of an intrusion, the Diamond Model of Intrusion Analysis (authored by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz) formalizes the mathematical and relational architecture of malicious activity.
The Atomic Building Block: The Event
In the Diamond Model, every intrusion is decomposed into atomic building blocks called Events . A single event represents an adversary utilizing a specific capability over an infrastructure against a victim at a specific point in time: Event ( E ) = ⟨ Adversary , Capability , Infrastructure , Victim ⟩ \text{Event } (E) = \langle \text{Adversary}, \text{Capability}, \text{Infrastructure}, \text{Victim} \rangle Event ( E ) = ⟨ Adversary , Capability , Infrastructure , Victim ⟩
- The Four Core Vertices [ADVERSARY]
- / \
- / \
- [CAPABILITY] ------------- [INFRASTRUCTURE]
- \ /
- \ /
- [VICTIM]
Adversary : The threat actor entity directing or executing the malicious activity. The model differentiates between:
Adversary Operator : The human individual sitting behind the keyboard executing commands.
Adversary Customer : The organization, intelligence agency, or criminal syndicate funding and directing the operation.
Capability : The tools, malware, exploits, and technical methodologies utilized by the adversary in the event (e.g., Cobalt Strike, PowerShell loaders, CVE-2023-38831 exploit code).
Infrastructure : The physical or logical communication networks and compute hardware used to deliver capabilities and control operations. Delineated into:
Type 1 Infrastructure : Hardware, servers, and domains owned, leased, or directly controlled by the adversary.
Type 2 Infrastructure : Compromised third-party infrastructure, zombie botnets, commercial VPN relays, or shared cloud microservices.
Victim : The target being attacked. Decomposed into:
Victim Organization : The enterprise or corporate entity.
Victim Persona : The specific human user, corporate role, or email account targeted.
Victim Asset : The specific endpoint, server, IP address, or cloud container undergoing exploitation.
The Two Primary Axes
Social-Political Axis (Adversary ⟷ \longleftrightarrow ⟷ Victim): Characterizes the human intent, motivation, and relationship between the adversary and the victim (e.g., geopolitical espionage, economic sabotage, financial extortion, hacktivism).
Technical Axis (Capability ⟷ \longleftrightarrow ⟷ Infrastructure): Characterizes the technical mechanisms connecting the attack tools with the communication infrastructure (e.g., C2 protocol packet encapsulation, beaconing ports, exploit delivery channels).
The Six Core Meta-Features
Every Diamond event is enriched with six analytical meta-features:
Timestamp : The start and end time of the event.
Phase : The corresponding attack lifecycle stage (e.g., Kill Chain Delivery phase).
Result : The operational outcome (Success, Failure, Unknown).
Direction : The traffic path across the diamond (Adversary-to-Infrastructure, Infrastructure-to-Victim, Bidirectional).
Methodology : The general attack class (e.g., Spear phishing, SQL injection, Kerberoasting).
Resources : Prerequisite assets required to sustain the event (e.g., software libraries, specialized hardware).
Activity Threads and Campaign Clustering
Activity Thread : A sequence of Diamond events linked chronologically that depict an adversary progressing through a single intrusion campaign.
Activity Groups & Clustering : When analysts discover multiple activity threads sharing identical Type 1 infrastructure (overlapping C2 IP spaces, shared TLS certificates) and shared capabilities (custom malware code reuse, distinct encryption routines), they cluster them into a single attributed threat actor group (e.g., APT29, FIN7).