Threat Intelligence: The Diamond Model of Intrusion Analysis

Note

Executive Summary: The Diamond Model of Intrusion Analysis is a foundational conceptual framework used in Cyber Threat Intelligence (CTI) and Incident Response. It describes any cyber intrusion event by mapping it to four core, interconnected elements. Rather than just listing Indicators of Compromise (IOCs), the Diamond Model provides a structured methodology for analysts to ensure no aspect of an attack is overlooked. It mathematically guides the investigation by highlighting the relationships (edges) between artifacts (vertices), transforming raw data into actionable intelligence and overarching threat campaigns.

1. The Core Philosophy: Four Facets of an Event

The model visualizes every malicious event as a diamond shape, consisting of four interconnected vertices. For any cyber attack to occur, all four of these elements must exist and interact.

Figure 1: The Diamond Model

Adversary (Who?)

The threat actor or organization responsible for the event. In the early stages of an investigation, this is often “Unknown.” The ultimate goal of CTI is to profile this vertex and potentially attribute it to a known group (e.g., APT28, Scattered Spider).

Capability (How?)

The tools, malware, or techniques utilized by the adversary. This could be a specific zero-day exploit, a custom ransomware payload, or native “Living off the Land” tools like PsExec or WMI.

Infrastructure (Where?)

The physical and logical structures the adversary uses to deliver capabilities and control the attack. This includes Command and Control (C2) IP addresses, phishing domain names, or compromised legitimate servers used as staging pivots.

Victim (Against Whom?)

The target of the adversary. This vertex is highly granular; it represents not just the corporate entity, but the specific employee (target of spear-phishing), the specific IP address, or the specific database being exfiltrated.

2. The Heart of the Model: The Art of Pivoting

The true power of the Diamond Model does not lie in defining the vertices, but in exploiting the edges (the relationships connecting them). The model formalizes the most critical mental activity of a DFIR analyst: Pivoting.

Pivoting is the analytical process of using one known data point to discover a new, unknown data point along the edges of the diamond.

1. Pivot Capability → Infrastructure: During a Ransomware Investigation, you reverse-engineer a suspicious executable (Capability). Dynamic analysis reveals it beacons out to 198.51.100.42 (Infrastructure).
2. Pivot Infrastructure → Adversary: You query the discovered IP address in your Threat Intelligence Platform (TIP). The intelligence feed correlates this IP with the known infrastructure of the Akira Ransomware Group (Adversary).
3. Pivot Adversary → Capability: Now that you suspect Akira, you consult their CTI profile. You learn that Akira heavily utilizes rclone for data exfiltration (Capability). You immediately query your SIEM to hunt for rclone execution on the Victim network.

Every IOC you uncover is a vertex on the diamond. The model forces the analyst to constantly ask: “Given this artifact, which other vertices can I logically deduce?“

3. Meta-Features: Adding Operational Context

To build a complete narrative, the base model is enriched with “Meta-features” that attach state and time to the event.

• Timestamp: The exact When. Crucial for ordering multiple diamonds into a sequence.
• Phase: The Where in the attack lifecycle. Every diamond is mapped to a specific phase of the Cyber Kill Chain or a MITRE ATT&CK tactic (e.g., an event might represent the “Credential Access” phase).
• Result: The Effect. Did the capability successfully compromise the victim, or was it blocked by the EDR?
• Direction: The flow of the attack (e.g., Victim-to-Infrastructure for a C2 callback, or Infrastructure-to-Victim for a phishing email delivery).

4. DFIR & CTI Operationalization

The Diamond Model bridges the gap between tactical incident response and strategic threat intelligence.

A. Identifying Blind Spots

During an active incident, the Diamond Model serves as a visual checklist. If a SOC team has identified the compromised server (Victim), the malicious domain (Infrastructure), and the dropped webshell (Capability), but cannot identify the Adversary, the model explicitly highlights this critical knowledge gap, directing the CTI team’s research efforts.

B. Building Activity Threads (Campaigns)

A single attack is never a single event; it is a sequence of actions. By chaining multiple diamonds together chronologically (e.g., Diamond 1: Phishing delivery → Diamond 2: Lateral Movement → Diamond 3: Exfiltration), analysts create an Activity Thread.

When multiple distinct Activity Threads (perhaps from different incidents months apart) share the same Infrastructure and Capability vertices but target different Victims, the analyst has successfully uncovered an overarching Threat Campaign.

C. The STIX Translation

The Diamond Model maps perfectly to the STIX 2.1 Standard. When organizations automate threat sharing, they are essentially transmitting digitized diamonds:

• SDO Threat-Actor = Adversary
• SDO Malware / Attack-Pattern = Capability
• SCO IPv4-Addr / Domain-Name = Infrastructure
• SDO Identity = Victim

By internalizing the Diamond Model, security professionals stop reacting to isolated SIEM alerts and begin tracking holistic, multi-dimensional adversaries.

---

References & Further Reading

• Center for Cyber Intelligence: The Diamond Model of Intrusion Analysis (Original Paper)
• Related Framework: STIX & Automated Threat Exchange
• Related Concept: Initial Access Brokers (IAB)