SYO-601 Attack Frameworks

Adversarial Tactics Techniques & Common Knowledge.

For each threat, at each stage in the life cycle, definitions, descriptions, and examples are given to better understand the full scope and nature of a threat

Intrusion Analysis

Intended to aid security analysts in understanding the relationship between elements and events in an intrusion.

The Diamond Model has four points (like a diamond):

(clockwise, starting from top)

adversary (who is attacking)
infrastructure (what component was taken advantage of)
victim (who or what was attacked)
capability (how the attack was deployed)

reconnaissance, in which a target is identified.

weaponization, in which a method of intrusion is acquired or developed.

delivery

exploitation stage, in which the delivered weapon is activated to take advantage of vulnerabilities

installation stage, in which methods of maintaining permanence are installed, such as backdoors.

command and control (C2) stage, in which the intruder has gained control of the target.

actions on objectives stage, in which the intruder takes the actions needed to fulfill their goals, such as extracting data.