A SOC analyst looks at an endpoint alert that says a finance PC ran PowerShell from inside a Word document, then connected out to an unfamiliar web address. On its own, that is one line in a console. Placed into a framework, it becomes a stage in a recognizable attack, and the analyst can predict what the attacker will try next and where to look for it.
That is what threat frameworks are for: shared models that describe how attacks unfold, so defenders can analyze, communicate and compare them. On the CompTIA Security+ SY0-801 exam the three named frameworks sit under objective 5.5 as reference sources for audit and assessment work. This lesson covers MITRE ATT&CK, the Lockheed Martin Cyber Kill Chain and the Diamond Model of Intrusion Analysis, what each one is good for, and how a single intrusion maps onto all three.
Threat frameworks give defenders a shared language for attacks
Before these models were common, every team described attacks in its own words, which made it hard to compare notes, write detections or brief leadership. A framework fixes that by giving a structured vocabulary.
The three in the objective answer different questions. The Cyber Kill Chain describes the sequence an intrusion follows, from the attacker's first research to the final payoff. MITRE ATT&CK catalogs the specific behaviors attackers use, organized by goal, in far more detail than the Kill Chain. The Diamond Model describes the elements of a single intrusion event, the attacker, what they used, what they used it from, and who they hit, and the relationships between them. The Kill Chain and Diamond Model are complementary rather than competing: a Diamond Model event can be tagged with the Kill Chain phase it belongs to.
They matter for assessment work because an assessor uses them to judge coverage. Mapping existing detections to ATT&CK, for example, shows which attacker behaviors would be caught and which would pass unnoticed, which is exactly the kind of gap an assessment is meant to find.
MITRE ATT&CK separates the attacker's goal from the method
ATT&CK, from the nonprofit MITRE, is a continually updated knowledge base of real-world adversary behavior, built from observed incidents and threat reporting. It is the most detailed of the three frameworks and the one you are most likely to meet on the job, because security tools tag their alerts with it.
Its two central ideas are tactics and techniques:
- A tactic is the attacker's goal, the "why" of an action: gaining initial access, escalating privileges, moving laterally, maintaining command and control, having impact. Tactics are the columns of the ATT&CK matrix.
- A technique is how the attacker achieves a tactic, the "what." Under each tactic sit many techniques, and many techniques have sub-techniques, which are more specific variants.
Techniques have stable IDs that start with the letter T. Phishing is T1566, and its sub-techniques include Spearphishing Attachment (T1566.001) and Spearphishing Link (T1566.002). OS Credential Dumping is T1003, and dumping credentials from the memory of the Windows LSASS process is the sub-technique T1003.001. The ID before the dot is the technique; the part after the dot is the sub-technique. Tactics have their own IDs that start with TA, so it is worth keeping the two apart: a question that calls a T-number a tactic has made an error you can spot.
ATT&CK has several matrices, including Enterprise (Windows, Linux, macOS, cloud and more), Mobile and ICS for industrial control systems. It is versioned and revised regularly as new behaviors are observed, so the exact set of tactics and techniques changes over time; treat any count you memorize as approximate and the technique IDs as the stable part.
Defenders use ATT&CK to describe an adversary's known techniques, to find detection gaps by mapping their coverage against the matrix, and to drive purple-team exercises in which each technique is tested and tuned. A related MITRE project, ATLAS, extends the same style to attacks on AI systems. On the exam, wording about "techniques and sub-techniques," "technique IDs" or "mapping attacker behavior" points to ATT&CK.