Structures for What You Found

Three structures do most of the organizing work, and each has a limit worth knowing.

The Diamond Model, published by Sergio Caltagirone, Andrew Pendergast and Christopher Betz in 2013, says every intrusion event has four features: adversary, capability, infrastructure, victim. In it, analysis proceeds by pivoting: from a piece of infrastructure to other victims, from a capability to other infrastructure. It is a structure for evidence, not a source of it, and the adversary corner is usually the emptiest.

The behavioral catalog, MITRE ATT&CK, gives a shared vocabulary: tactics are the objective, such as persistence or exfiltration; techniques are the method; and a specific actor's implementation is its procedure.

The trap is mapping eleven techniques and concluding you have named an actor. Groups share tooling, copy published playbooks and buy the same commodity capabilities. Description is not attribution.

The kill chain, from Eric Hutchins, Michael Cloppert and Rohan Amin at Lockheed Martin, sequences an intrusion from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives. It is useful as a first frame and it dates from 2011: built around malware delivered at a perimeter, it handles insiders, stolen credentials, web-application attacks, and lateral movement poorly.

Use them to find the question you have not asked. The value of a structure is the empty cell it makes visible.