What is the Diamond Model of Intrusion Analysis?
The Diamond Model of Intrusion Analysis is a framework for analyzing cyber intrusions, published in 2013 by Sergio Caltagirone, Andrew Pendergast and Christopher Betz. Its central idea is that every intrusion event has four core features, drawn as the corners of a diamond, and that the relationships between them let an analyst move from one clue to the next. Threat intelligence teams use it to correlate individual events into campaigns and to reason about who is behind an attack.
The four core features
- Adversary: the person or group responsible for the attack. In practice this is often the least known corner.
- Capability: the tools and techniques used, such as malware, exploits, stolen credentials or a phishing kit.
- Infrastructure: the systems the adversary uses to deliver capabilities and keep control, such as sending domains, command-and-control servers, compromised websites and drop accounts.
- Victim: the target, which may be an organization, a person, an email address, a system or a network.
The edges read as a sentence: an adversary uses a capability, over some infrastructure, against a victim.
Pivoting between features
The model's main practical use is pivoting, where each discovered feature becomes a lead to the others. A malware sample (capability) contains a hard-coded C2 domain (infrastructure). Passive DNS shows that the domain resolved to an IP address that also hosted several other domains. Those domains appear in phishing emails sent to other companies in the same industry (victims). The targeting pattern and tooling match a group already described in threat intelligence reporting (adversary). Starting from one artifact, the analyst has mapped a wider campaign and found new indicators of compromise to block and hunt for.
Meta-features, threads and axes
Each event also carries meta-features: a timestamp, the Kill Chain phase, the result, the direction (for example, victim to infrastructure), the methodology and the resources required. Events that follow one another in an attack can be linked into activity threads, and events and threads with similar features can be clustered into activity groups, often used to track one adversary's operations.
The model also describes two axes. The technology axis connects capability and infrastructure, the technical means of the attack. The social-political axis connects adversary and victim, the relationship that captures motive and why this victim was chosen.
Diamond Model vs. Kill Chain vs. ATT&CK
| Framework | Focus | Best for |
|---|---|---|
| Diamond Model | Four features of one event and their relationships | Pivoting, correlation, attribution |
| Cyber Kill Chain | Seven ordered phases of an intrusion | Telling the story and choosing where to break it |
| MITRE ATT&CK | Catalog of tactics and techniques | Detection coverage, hunting, emulation |
The frameworks complement each other. A Diamond Model event can be tagged with its Kill Chain phase and with the ATT&CK technique it represents, so an analyst can move between the timeline, the behavior and the relationships.
Diamond Model of Intrusion Analysis on the CompTIA Security+ exam
The Diamond Model is one of the threat frameworks named in SY0-801 objective 5.5 as a reference source for assessment work. Scenario wording about adversary, capability, infrastructure and victim, or about pivoting from a C2 address or malware sample to find related activity and other victims, points at the Diamond Model. Ordered phases point at the Cyber Kill Chain, and tactics with technique IDs point at MITRE ATT&CK. A common trap is mixing up capability and infrastructure: the malware is a capability, while the server it calls home to is infrastructure.