Kill Chain, Diamond Model, ATT&CK: Three Maps of the Same Attack, and When to Use Each

An intrusion is one sequence of events. CySA+ objective 3.1 gives you three different ways to describe it, and the exam's trick is that each framework is the right answer to a different question. Ask "where can we stop this" and you want the Kill Chain. Ask "what exactly did they do, in a language another team will understand" and you want ATT&CK. Ask "who is behind this and what else have they touched" and you want the Diamond Model. Here are all three drawn over the same attack.

Why three frameworks, and not one

Each framework was built by people with a different job. Lockheed Martin's analysts wanted a way to show that a targeted intrusion has stages and that stopping any one stage stops the intrusion. MITRE wanted a shared catalog of what adversaries actually do, specific enough that a detection engineer and a threat intelligence analyst could mean the same thing by the same name. The Diamond Model's authors wanted a way to reason about the adversary as an entity that persists across incidents, with infrastructure and capabilities that can be tracked.

Those are three different questions, and the exam expects you to route a scenario to the framework that answers it.

The Cyber Kill Chain: seven phases and one idea

The Cyber Kill Chain describes a targeted intrusion as seven sequential phases. Its power is the sequence: because each phase depends on the one before, a defender who breaks any link stops the chain.

1. Reconnaissance: the attacker researches the target, from job postings to exposed services.
2. Weaponization: they build the payload, typically pairing an exploit with a backdoor inside a deliverable file.
3. Delivery: the payload reaches the target, by email, web, USB or a compromised site.
4. Exploitation: the vulnerability is triggered and code runs.
5. Installation: the attacker establishes persistence so access survives a reboot.
6. Command and control: the implant calls home and takes instructions.
7. Actions on objectives: the actual goal, whether exfiltration, encryption or sabotage.

The exam tests two things beyond the order. First, which phase a piece of evidence belongs to: a phishing email is delivery, a new scheduled task is installation, beaconing to an unknown domain is command and control. Second, which control breaks which link: awareness training and email filtering at delivery, patching at exploitation, application allow-listing at installation, egress filtering and DNS monitoring at command and control. Breaking the chain is the defensive lesson, and the earlier the break, the less damage.

Its known weakness, which the exam also knows, is that it assumes an attacker coming from outside, in order. Insider threats and attacks that skip phases (a stolen credential needs no exploitation) fit it badly, which is part of why ATT&CK exists.

MITRE ATT&CK: a shared vocabulary of behavior

ATT&CK is a catalog, not a sequence. It organizes adversary behavior into tactics, which are the goals (initial access, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact, and a few more), and techniques, which are the specific ways of achieving them. Each technique has an ID, and many have sub-techniques.

The distinction the exam draws is tactic versus technique. A tactic is why: the attacker wants persistence. A technique is how: a scheduled task, a registry run key, a new service. When a stem describes what the attacker did and asks for the tactic, look for the goal. When it asks for the technique, look for the method.

The IDs are what make ATT&CK useful in practice. Two analysts in different organizations, a threat intelligence report, a detection rule and a red team plan can all refer to the same behavior by its ID and mean exactly the same thing. That is why the outline calls out technique IDs and shared vocabulary: ATT&CK is the common language, and a heat map of which techniques your detections cover is the standard way of showing where the gaps are.