Security+ SY0-801 discusses three ways of organizing an intrusion: MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model. They are not competing names for the same chart. The answer depends on whether the question focuses on behavior, progression, or relationships.
1. Three models at a glance
| Model | Primary lens | Useful question |
|---|---|---|
| MITRE ATT&CK | Observed adversary tactics, techniques, and sub-techniques | How does the attacker achieve a goal? |
| Cyber Kill Chain | A high-level sequence of attack activity | At which point could defenders interrupt the progression? |
| Diamond Model | Relationships among an adversary, infrastructure, capability, and victim | What connects this event to another event or target? |
All three can inform detection and analysis. None guarantees a complete description of every attack.
2. MITRE ATT&CK
ATT&CK is a knowledge base of adversary behavior observed in the real world. A tactic describes the purpose of an action, while a technique describes a method used to reach that purpose. A sub-technique is a more specific form of a technique.
Example: An attacker uses stolen credentials to access another machine. The analyst identifies the relevant ATT&CK behavior, then checks whether available telemetry would detect it. ATT&CK is especially useful for detection coverage, investigation notes, threat hunting, and mapping observed behavior to defensive controls.
The matrix is not a required timeline. Attackers may revisit tactics, combine techniques, or skip activities entirely. Don't choose a stage number merely because an ATT&CK name appears in a scenario.
3. Cyber Kill Chain
Lockheed Martin's Cyber Kill Chain organizes a traditional intrusion into broad stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Its practical question is where could the attack be detected, prevented, or disrupted? For example, blocking a malicious attachment at delivery prevents later exploitation in that particular route. An organization might also use endpoint controls to disrupt execution or command and control if delivery was missed.
Treat it as a way to reason about an attack sequence, not proof that every intrusion follows each stage neatly. Insider attacks, cloud-native misuse, and some credential attacks can be difficult to fit into a simple linear diagram.
4. Diamond Model
The Diamond Model describes a malicious event using four core features:
- Adversary: The actor responsible for the activity, which may initially be unknown.
- Infrastructure: Systems, accounts, or services used to support the activity.
- Capability: The method, tooling, or exploit used.
- Victim: The entity or system targeted.
Example: Two incidents target different departments but use the same suspicious domain and a similar tool. An analyst can explore infrastructure and capability relationships without claiming that the actor is identified. The model supports comparing events and developing hypotheses about connected activity.
Evidence may leave one corner of the diamond unknown. Analysts should distinguish confirmed observations from hypotheses.
5. Choose a model from the evidence
| Scenario clue | Best starting model | Why |
|---|---|---|
| Map a credential-theft technique to detections | MITRE ATT&CK | Focus is observed behavior and controls |
| Find the stage where email filtering could have stopped an intrusion | Cyber Kill Chain | Focus is attack progression and intervention |
| Link two incidents by attacker infrastructure and tooling | Diamond Model | Focus is relationships among event features |
| Ask why a technique was performed | MITRE ATT&CK | Tactics capture the adversary objective |
| Reconstruct which components of a suspicious event are known | Diamond Model | Documents actor, infrastructure, capability, and victim |
Avoid the common mix-up: Incident-response phases such as preparation, detection, containment, and recovery describe what defenders do. ATT&CK and the Kill Chain describe adversary behavior or attack progression. The Diamond Model describes relationships in intrusion events. A scenario may mention all of them, but its question chooses the lens.
6. Rapid review grid
- Tactic = why; technique = how: MITRE ATT&CK.
- Reconnaissance through actions on objectives: Cyber Kill Chain.
- Adversary, infrastructure, capability, victim: Diamond Model.
- When to contain or recover: Incident-response workflow, not an attacker framework.
- Shared IP or tool across events: Investigate relationships before attributing an adversary.