Analysis models: the Cyber Kill Chain and the Diamond Model
In short: The Cyber Kill Chain splits an attack into seven ordered phases, showing where defenders can break it. The Diamond Model describes each intrusion event by adversary, capability, infrastructure and victim, which helps analysts pivot from one clue to related ones.
Why use analysis models?
Raw incident data is messy: alerts, logs, emails and malware samples. Models give analysts a structure to organise it, spot missing pieces and explain findings to others. Two classic models are the Cyber Kill Chain and the Diamond Model. They are often used together with MITRE ATT&CK, which adds much finer detail.
The Cyber Kill Chain
Published by Lockheed Martin in 2011, the Kill Chain adapts a military idea: an attack is a chain of steps, and breaking any link stops it. Its seven phases are reconnaissance, weaponisation, delivery, exploitation, installation, command and control (C2), and actions on objectives.
| Phase | Example defence |
|---|---|
| Reconnaissance | Limit public staff details; monitor for scanning |
| Weaponisation | Hard to see directly; intelligence on attacker tooling |
| Delivery | Email filtering, web proxy, USB control |
| Exploitation | Patching, disabling macros, exploit protection |
| Installation | Application control, EDR, least privilege |
| Command and control | DNS filtering, egress firewall rules, proxy inspection |
| Actions on objectives | Data loss prevention, backups, segmentation |
Its strength is simplicity: it shows managers that defence should cover the whole chain, and the earlier you break it the cheaper the incident. Its weaknesses are well known. It focuses on perimeter intrusions using malware, fits insider threats and cloud account takeover poorly, and treats an attack as a straight line when real attackers loop back and move laterally many times.
The Diamond Model
The Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) says every intrusion event has four core features: an adversary uses a capability over some infrastructure against a victim. Extra meta-features include timestamp, phase, result, direction and methodology.
Its main practical use is pivoting. Suppose you find a malicious domain (infrastructure) in a phishing email. You can pivot to other victims who received mail linking to that domain, to the malware (capability) it served, and to other domains registered with the same details, which may reveal more of the adversary's infrastructure. Linked diamonds over time form an activity thread that tells the story of a campaign.
Choosing and combining models
- Use the Kill Chain to explain an attack at a high level and to check defences cover every phase.
- Use the Diamond Model during investigations to connect evidence and group related activity.
- Use ATT&CK for detailed technique-level mapping and detection work.
Some practitioners also use the Unified Kill Chain, which merges ideas from the Kill Chain and ATT&CK into a longer sequence covering the stages inside a network. In exams, be ready to name the seven Kill Chain phases, the four Diamond features, and one limitation of each model.
Real-world example: breaking the chain at a law firm
A fictional law firm investigates an intrusion attempt using the Cyber Kill Chain. Reconnaissance: staff names were taken from the firm's website. Weaponisation and delivery: a document with a malicious macro was emailed to a paralegal. Exploitation stopped there, because macros from the internet were blocked by policy. The analysts then use the Diamond Model on the event: the capability (the macro document), the infrastructure (a sending domain registered two days earlier), the victim (the paralegal) and an unknown adversary. Pivoting on the infrastructure, they find two more emails from the same domain sent to other staff, which they quarantine. The models helped them see where the attack failed and where else to look.
Practice
Which Kill Chain phase does blocking a malicious domain at DNS mainly disrupt?
Name the four core features of the Diamond Model.
Give one limitation of the Cyber Kill Chain.
Key takeaways
- Models give structure to messy incident data.
- The Kill Chain has seven phases; breaking any link can stop an attack.
- The Diamond Model links adversary, capability, infrastructure and victim.
- Pivoting between Diamond features uncovers related activity.
- Combine Kill Chain, Diamond and ATT&CK for different purposes.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.