Diamond Model of Intrusion Analysis

What Is the Diamond Model of Intrusion Analysis?

The Diamond Model is a way to record and reason about attack activity. Its basic unit is the event: one step an attacker takes, such as one phishing call or one malware callback. The paper’s first axiom puts it in one line. “For every intrusion event there exists an adversary taking a step towards an intended goal by using a capability over infrastructure against a victim to produce a result.”

The model is named after its shape. The four core features sit on the corners of a diamond, and the lines between them show which feature can reveal another. Three analysts, Sergio Caltagirone, Andrew Pendergast and Christopher Betz, set it out in a 61-page paper in 2013. They built it by asking of their own work: “What is the underlying method to our work?”

Many short guides stop at the four corners. The paper goes further, with meta-features, seven axioms, activity threads that chain events in order, and activity groups that cluster threads into campaigns. This page covers each part. It then fills a diamond with a real group from our threat group library and turns it into a detection plan.

What Are the Four Corners of the Diamond?

Each corner can be as broad or as detailed as the case needs. The paper also splits each one into parts that matter in daily work.

Two details in that table matter later. The paper lists malicious domain names, staging servers and compromised email accounts as Type 2 infrastructure, because this is what the victim sees in place of the real operator. A victim asset can also become infrastructure in the next event, such as a hacked mailbox used to phish a partner. In the paper’s words, “the apparent target of activity may not necessarily be the victim.”

What Are Meta-Features and Confidence Values?

Around the four corners, every event carries meta-features. The paper lists six of them:

• Timestamp: start and end time, so older knowledge can lose weight as the attacker changes.
• Phase: where the event sits in the attack. Any phased model works, such as the cyber kill chain.
• Result: success, failure or unknown, or which of confidentiality, integrity and availability was hit.
• Direction: one of seven values, such as Infrastructure-to-Victim, Victim-to-Infrastructure or Bidirectional. It shows where a sensor or a block can sit.
• Methodology: the class of activity, such as spear-phish email or port scan.
• Resources: what the event needed, such as software, knowledge, a stolen password, money for domains or network access.

Every feature, core or meta, also carries a confidence value. The paper leaves the scale to each team. An empty feature is not a failure. The paper calls it a knowledge gap, a prompt for the next pivot.

The extended diamond adds two links that cross the shape. Social-political joins adversary and victim: the adversary has a need, such as income or espionage, and the victim can meet it. Technology joins capability and infrastructure: the protocols that let them work together, such as DNS and HTTP for malware that looks up a domain and calls home.

What Are the Seven Axioms of the Diamond Model?

The paper states seven axioms. Some guides list different ones, so here they are in the paper’s own order, shortened, with what each one means for a defender.

Axiom 7 leads to two useful labels. A victim of opportunity is expendable: the attacker would likely not notice losing access. A victim of interest is worth enough that the attacker would spend resources to get back in.

How Does Pivoting Work in the Diamond Model?

Pivoting means taking one data element and using it, with a data source, to find related elements. The paper says the diamond “was originally revealed after exploring pivot scenarios.” Its own example has five pivots:

1. A victim finds malware on its network.
2. Reverse engineering the malware exposes its command and control domain.
3. Resolving the domain exposes the IP address of the malware’s controller.
4. Firewall logs show other internal hosts talking to that IP address.
5. The registration of the IP address reveals details that may point to the adversary.

In the paper’s formal graph, five edges join the corners: adversary to capability, adversary to infrastructure, infrastructure to capability, infrastructure to victim, and capability to victim. Adversary and victim have no direct edge. What connects them is the social-political meta-feature.

The paper also names “centered” approaches, after the corner where the work starts:

• Victim-centered: most security teams already work this way through their own monitoring. The paper’s example is the Honeynet Project, which sets up hosts that are meant to be attacked.
• Capability-centered: start from a malware sample. The paper cites Kaspersky’s “Red October” work, which went from the malware to “over 1000 different” related files, then to the infrastructure, then sinkholed it to find victims.
• Infrastructure-centered: start from a domain or IP address. In the paper’s SKHack example, analysts went from callback domains through WHOIS records to other domains with the same registrant. That mapped infrastructure the attack had not used yet.
• Adversary-centered: watch the adversary directly. This needs access that few teams have.
• Social-political and technology-centered: predict likely victims from the adversary’s needs, or hunt misuse of a technology such as DNS.

The paper adds a warning: the diamond shows what is possible, not what is certain. Registration details can be false. Even so, a fake persona used the same way every time can still be tracked.

What Does a Diamond Look Like for a Real Group?

Here is one diamond filled in from public sources. Scattered Spider is attributed by MITRE ATT&CK (group G1015) and by the FBI, CISA and partner agencies as a cybercriminal group. It targets large companies and their contracted IT help desks.

The main source is the joint advisory AA23-320A, first published on 16 November 2023. Its update of 29 July 2025 uses FBI data as recent as June 2025.

The event below is the help desk takeover that the advisory describes. It is a model built from the advisory, not one real incident.

The rest of the attack forms an activity thread, with one diamond per phase. The adversary corner stays the same in each row.

Many of these corners are service providers in the paper’s sense. RMM vendors, MEGA and Amazon S3 are legitimate services. So the defence on those corners is to approve and watch their use, not to block a vendor outright.

How Does the Diamond Turn Into a Detection Plan?

Each edge of the diamond, and the resources an event needs, is a question you can ask of your own data. The table follows the pivots in the example above. It names the data that answers each question, and the control the advisory or the UK NCSC recommends where there is one.

The paper’s planning section says to choose actions that cost the defender little and the adversary much. A blocked domain costs this attacker one new registration. A help desk that checks identity, and logins that are reset before they are used, take away the resources the whole thread depends on.

A team can store each event as a simple record. Here is a template for the help desk event above. Values in angle brackets come from your own logs. The low, medium and high scale is our example, since the paper leaves the scale to each team.

event:          help desk password and MFA reset
phase:          delivery (cyber kill chain)
time_start:     <first call in the help desk log>
time_end:       <new MFA device registered>
adversary:      Scattered Spider             confidence: low (process match only)
capability:     vishing, T1566.004           confidence: high
infrastructure: caller number <number>       confidence: medium
                <brand>-sso.<tld> lookalike  confidence: <if seen>
victim_persona: IT help desk; employee with admin rights
victim_asset:   SSO account <user>           confidence: high
result:         success (password reset, MFA moved)
direction:      Infrastructure-to-Victim
methodology:    vishing; MFA reset abuse
resources:      employee personal data (source unknown)
gaps:           owner of the caller number; source of the personal data

How Do Events Become Activity Threads and Activity Groups?

An activity thread is the phase-ordered chain of events for one adversary and one victim. Each arrow between two events carries four labels:

• a confidence value;
• AND if the step is required, or OR if it is one of several routes;
• actual, or only a hypothesis;
• what the earlier event provided to the next one.

Filling gaps inside one thread is vertical correlation. Linking threads across victims is horizontal correlation. In the paper’s example, the attacker uses a network administrator’s mailbox at one company to send the same payload to a research firm.

An activity group clusters events and threads that share features or behavior. The paper gives six steps: define the analytic problem, select features, create the groups, grow them as new events arrive, analyse them, and redefine them when they drift. Groups that share non-technical traits, such as one source of funding and tasking, form an activity group family.

The features depend on the question. Grouping for attribution needs different features than grouping to find shared malware authors. The paper’s sample feature vector combines an infrastructure IP address, a capability hash and an adversary process.

The adversary process is the most durable of these. It is the order of steps an attacker prefers.

The paper’s example is a web search for “network administrator”, then a spear-phish with a trojanized attachment, then a known exploit, then an HTTP POST out. Attackers swap IP addresses and malware often. Their habits change more slowly.

This matters for Scattered Spider. The UK National Crime Agency said on 16 July 2026 that its action against two leading members effectively halted the group, while others may reuse the name. A team that groups activity by process will still catch a copycat: help desk resets, then new MFA devices, then RMM tools. A team that groups only by name will not.

The paper also warns about overfitting. An unrelated event joins a group because two actors share a public tool or hosting, and that wrong event is then used to match more. Groups need review and redefinition over time.

What Changes When Several Criminals Share One Intrusion?

The 2013 model draws one adversary per diamond. Cybercrime today often splits one attack between several sellers and buyers. In May 2025 Cisco Talos proposed an extended Diamond Model with a “Relationship Layer” for these split attacks. It labels the links between diamonds, such as “purchased from”, “handover from” and “leaked from”.

Talos showed why with an intrusion it found in 2023 at a critical infrastructure enterprise. A first wave stole credentials and planted a custom backdoor, which Talos calls LAGTOY, that was then never used. About three weeks later a ransomware group arrived with different tools and logged in with the credentials from the first wave.

Talos concluded that an initial access broker had handed over access. The first reading, one group behind both waves, would have put the backdoor in the ransomware group’s toolset.

Our own research sees the same split in criminal offers. The chapter How Cybercriminals Divide the Work of Cybercrime Report 2026 compares four advertised offers from the report’s catalogues. In one, an infostealer licensee may sell access to a compromised machine, with its logs, to a third buyer who is said to need no subscription. The chapter warns that merging such roles “would turn a product description into unsupported attribution or an unconfirmed incident.”

So draw one diamond per actor and label the link between them, such as “purchased from” for the access seller.

In the report’s Initial Access Offers chapter, we read 120 corporate network access offers in full, posted from 1 January to 27 October 2026. Counting one repeated firewall family once, 48 of 106 named an edge device or remote-access service. These are advertised offers, not verified breaches, but an access seller’s diamond often starts at the perimeter.

How Does It Compare With the Cyber Kill Chain and MITRE ATT&CK?

The three models answer different questions, and teams use them together. The paper calls the Diamond Model and kill chain analysis “highly complementary”. Each event’s phase can come from the kill chain. An activity thread can then be read against the kill chain’s course of action matrix: detect, deny, disrupt, degrade, deceive and destroy.

In practice, ATT&CK IDs fill the capability corner, the kill chain fills the phase, and the diamond keeps the links between them. Our pages on the cyber kill chain and MITRE ATT&CK explain the other two.

How Do You Store Diamond Events in STIX?

The paper does not define a sharing format, but its authors expected the model to form the basis of one. STIX 2.1, the OASIS standard for threat intelligence, has objects that fit each corner. See our page on STIX and TAXII for how the data moves.

STIX defines an intrusion set as “a grouped set of adversarial behaviors and resources with common properties that is believed to be orchestrated by a single organization.” That is close to the paper’s activity group.

What Are the Limits of the Diamond Model?

• It is manual. The authors wrote that the model “at present is cognitive and highly manual” and would be far more useful with automation.
• The adversary is often unknown. The paper expects this corner to be “empty for most events”, at least when they are found.
• Pivots can mislead. Shared hosting, public tools and fake registration details can join events that are not related.
• One actor per diamond does not fit shared crime. Access brokers and service providers need their own diamonds and labelled links, as Talos proposed.
• Correlation is not causation. The paper says this about linking attacks to political events, and it holds for every pivot.

How Do You Start Using It?

1. Take one recent alert and write it as an event: four corners, six meta-features and a confidence for each.
2. Mark the empty fields as knowledge gaps, and pick the pivot that fills the most of them.
3. Give the event a phase, and look for the events before and after it.
4. Compare the thread with a known group’s profile by process, not only by indicators of compromise.
5. Turn each edge into a detection or control, as in the table above, and record which pivots paid off.

Brandefense Cyber Threat Intelligence tracks 1,000+ threat actors and 100+ ransomware groups. It sends its findings to SIEM and SOAR tools, and offers them through an API with STIX 2.0 and TAXII 2.1.