Diamond Model Overview

Question 1

Diamond Model

Answer 1

• Systematic method to analyze events in a repeatable way so that threats can be organized, tracked, sorted, and countered.
• It’s a framework by which a SOC team can organize and verify APT and then use that knowledge to thwart malicious adversaries.
• Typically an Adversary uses a Capability over an Infrastructure to Attack a victim.

Question 2

Adversary

Answer 2

• The entity responsible for conducting an intrusion.

Question 3

Capability

Answer 3

• A tool or technique that the attacker may use in an event.

Question 4

Victim

Answer 4

• The target of the attacker.

Question 5

Infrastructure

Answer 5

The physical or logical communications nodes that the attacker uses to establish and maintain command and control.

Question 6

Type 1 Infrastructure

Answer 6

• Owned and controlled by the adversary.

Question 7

Type 2 Infrastructure

Answer 7

• Co-Opted by the adversary, but is owned by a third party that may or may not know the adversary is using the infrastructure.
• The true identity of the adversary is obfuscated
• The Attacker gains access solely for “hopping” through during an attack.
• To the target the attacker would appear as if coming form an intermediary “hop” and cloak the attacker’s true identity.

Question 8

Service providers

Answer 8

• provides type 1 and type 2 Infrastructure and includes ISPs.

Question 9

Exploit Kits

Answer 9

• Sets of tools that are utilized to gain access to a targeted host.
• usually automated and target client-side Vulnerabilities
• Usually easy to obtain and use
• Launching pad to deliver payload.

Question 10

Neutrino

Answer 10

• Targets Java runtime environment, drops Ransomware on target systems.

Question 11

Magnitude

Answer 11

• Commonly utilized to drop Ransomware on target systems

Question 12

Angler

Answer 12

Very versatile, utilizes a robust toolkit

Question 13

Nuclear

Answer 13

Largely targets vulnerable adobe flash Vulnerabilities, largely safe from AV detection.