Module 6 - The Cyber Kill Chain & Diamond Model

Question 1

The Cyber Kill Chain

Answer 1

• Developed by Lockheed Martin to combat cyber intrusions.
• Consists of seven sequential steps.
• Aids in understanding threat actor techniques and procedures.
• Early detection and prevention are essential to minimize damage.
• If the attacker is stopped at any stage, the attack is thwarted.
• Completion of Step 7 is necessary for threat actors to succeed.

Question 2

The 7 Steps of the Cyber Kill Chain

Answer 2

• Reconnaissance
• Weaponisation
• Delivery
• Exploitation
• Installation
• Command & Control
• Actions on Objectives

Question 3

Reconnaissance

Answer 3

Reconnaissance is when the threat actor performs research, gathers intelligence, and selects targets. This will inform the threat actor if the attack is worth performing.

Question 4

Weaponisation

Answer 4

The goal of this step is to use the information from reconnaissance to develop a weapon against specific targeted systems or individuals in the organization. To develop this weapon, the designer will use the vulnerabilities of the assets that were discovered and build them into a tool that can be deployed.

Question 5

Delivery

Answer 5

During this step, the weapon is transmitted to the target using a delivery vector. This may be through the use of a website, removable USB media, or an email attachment. If the weapon is not delivered, the attack will be unsuccessful.

Question 6

Exploitation

Answer 6

After the weapon has been delivered, the threat actor uses it to break the vulnerability and gain control of the target. The most common exploit targets are applications, operating system vulnerabilities, and users. The attacker must use an exploit that gains the effect they desire

Question 7

Installation

Answer 7

This step is where the threat actor establishes a back door into the system to allow for continued access to the target. To preserve this backdoor, it is important that remote access does not alert cybersecurity analysts or users. The access method must survive through antimalware scans and rebooting of the computer to be effective.

Question 8

Command and Control

Answer 8

In this step, the goal is to establish command and control (CnC or C2) with the target system. Compromised hosts usually beacon out of the network to a controller on the internet. This is because most malware requires manual interaction in order to exfiltrate data from the network. CnC channels are used by the threat actor to issue commands to the software that they installed on the target.

Question 9

Actions and Objectives

Answer 9

The final step of the Cyber Kill Chain describes the threat actor achieving their original objective. This may be data theft, performing a DDoS attack, or using the compromised network to create and send spam or mine Bitcoin. At this point the threat actor is deeply rooted in the systems of the organization, hiding their moves and covering their tracks. It is extremely difficult to remove the threat actor from the network.

Question 10

Diamon Model

Answer 10

The Diamond Model of Intrusion Analysis is made up of four parts and represents a security incident or event. In the Diamond Model, an event is a time-bound activity that is restricted to a specific step in which an adversary uses a capability over infrastructure to attack a victim to achieve a specific result.

The four core features of an intrusion event are
- adversary
- capability
- infrastructure,
- victim

Question 11

Adversary

Answer 11

These are the parties responsible for the intrusion.

Question 12

Capability

Answer 12

This is a tool or technique that the adversary uses to attack the victim.

Question 13

Infrastructure

Answer 13

This is the network path or paths that the adversaries use to establish and maintain command and control over their capabilities.

Question 14

Victim

Answer 14

This is the target of the attack. However, a victim might be the target initially and then used as part of the infrastructure to launch other attacks.

Question 15

Meta-features of the diamond Model

Answer 15

• Timestamp
• Phase
• Result
• Direction
• Methodology
• Resources

Question 16

Timestamp

Answer 16

This indicates the start and stop time of an event and is an integral part of grouping malicious activity.

Question 17

Phase

Answer 17

This is analogous to steps in the Cyber Kill Chain; malicious activity includes two or more steps executed in succession to achieve the desired result.

Question 18

Result

Answer 18

This delineates what the adversary gained from the event. Results can be documented as one or more of the following: confidentiality compromised, integrity compromised, and availability compromised.

Question 19

Direction

Answer 19

This indicates the direction of the event across the Diamond Model. These include Adversary-to-Infrastructure, Infrastructure-to-Victim, Victim-to-Infrastructure, and Infrastructure-to-Adversary.

Question 20

Methodology

Answer 20

This is used to classify the general type of event, such as port scan, phishing, content delivery attack, syn flood, etc.

Question 21

Resources

Answer 21

These are one or more external resources used by the adversary for the intrusion event, such as software, adversary’s knowledge, information (e.g., username/passwords), and assets to carry out the attack (hardware, funds, facilities, network access).