Adversary Models: MITRE ATT&CK and Related Frameworks

• Adversary Models: MITRE ATT&CK and Related Frameworks
  • Why model the adversary?
  • The Cyber Kill Chain
    • The Seven Phases
    • Strengths and Limitations
  • The Diamond Model of Intrusion Analysis
    • The Four Features
    • Meta-Features
    • Activity Threads and Campaigns
    • Diamond Model in Practice
  • MITRE ATT&CK
    • Structure
    • The Three Matrices
    • Enterprise Tactics
    • Reading a Technique Entry
    • The ATT&CK Navigator
  • MITRE D3FEND
    • Structure
  • MITRE ENGAGE
    • Goals
    • Practical Applications
  • The Unified Kill Chain
    • Three Macro-Phases
    • 18 Phases (abbreviated)
  • Applying the Frameworks
    • In Digital Forensics Investigations
    • In Malware Analysis
    • Threat Intelligence Integration
  • Framework Comparison
  • Tools
  • Key takeaways
  • References

Why model the adversary?

Adversary modeling frameworks give analysts a shared vocabulary for describing attacker behavior. Without a common language, one analyst’s “lateral movement” is another’s “network pivot,” and correlating findings across cases, tools, and teams becomes impossible. These frameworks exist at two levels: kill chains describe the sequence of an intrusion from first contact to mission completion, while technique catalogs like ATT&CK describe the specific actions an adversary takes at each stage.

This page covers the major frameworks and how to apply them in both digital forensics investigations and malware reverse engineering.

ℹ️ These frameworks are complementary, not competing. A real analysis uses the Kill Chain to describe the arc, the Diamond Model to track actors and infrastructure, and ATT&CK to label every specific technique observed. Keep that division of labor in mind as you read.

The Cyber Kill Chain

Lockheed Martin introduced the Cyber Kill Chain in 2011, borrowing the military concept of a “kill chain” — a series of steps that must all complete for an attack to succeed. Disrupting any single link breaks the chain.

The Seven Phases

Reconnaissance → Weaponization → Delivery → Exploitation
      → Installation → C2 → Actions on Objectives

Strengths and Limitations

Strengths:

• Simple mental model; easy to explain to non-technical stakeholders
• Each phase is a defensive opportunity: block delivery and exploitation never happens
• Maps well to perimeter-centric defenses

Limitations:

• Linear — doesn’t capture adversaries who cycle back or operate in parallel
• No coverage of insider threats or supply chain attacks (no initial delivery needed)
• Does not describe how any phase is accomplished (no technique detail)
• Reconnaissance (phase 1) often happens entirely outside the defender’s visibility

The Kill Chain answers “where in the attack are we?” It does not answer “exactly what did the attacker do?”

The Diamond Model of Intrusion Analysis

Developed by Caltagirone, Pendergast, and Betz (2013), the Diamond Model is built on the observation that every intrusion event has exactly four features: an adversary uses a capability over infrastructure against a victim. These four features form the corners of a diamond, with edges representing their relationships.

        Adversary
       /          \
  Capability ─── Infrastructure
       \          /
         Victim

The Four Features

Meta-Features

Each diamond can be annotated with meta-features:

• Timestamp — when the event occurred
• Phase — Kill Chain phase
• Result — success, failure, unknown
• Direction — adversary-to-victim or victim-to-adversary (C2 check-in vs. exfil)
• Methodology — category of technique (social engineering, exploit, brute force)
• Resources — what the adversary needed (specific software version, inside knowledge)

Activity Threads and Campaigns

A single diamond represents a single event. Connecting diamonds over time builds an activity thread — the sequence of events in a single intrusion. Grouping threads that share a common adversary or infrastructure creates a campaign. This is how forensic investigators and threat intelligence teams pivot from “one infected host” to “this is APT29.”

Event 1              Event 2              Event 3
[Phishing email] → [Macro execution] → [Beacon to C2]
  Same victim          Same victim         Same adversary infra
  ─────────────── activity thread ──────────────────────────▶

Diamond Model in Practice

For forensics:

• Start with what you know: the victim (infected host) and the capability (malware hash found on disk).
• Pivot to infrastructure: what IP/domain did the malware contact? Who else has reported that IP?
• Pivot to adversary: does the infrastructure overlap with known threat groups in threat intelligence feeds?

For malware analysis:

• The capability (your sample) is the center of the analysis.
• Reverse engineering reveals infrastructure (hard-coded C2s, domains).
• Behavioral analysis reveals victim targeting (targeted file extensions, geographic checks, specific process names killed).

MITRE ATT&CK

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior. MITRE began building it in 2013 from observations of real intrusions against real organizations. It is the current industry standard for technique-level threat description.

Structure

ATT&CK is organized as a three-level hierarchy:

Tactic          (the adversary's goal — the "why")
  └── Technique (how they achieve the goal — the "what")
        └── Sub-technique (a more specific implementation)

A Tactic is a high-level objective: Persistence, Lateral Movement, Exfiltration. There are 14 tactics in the Enterprise matrix.

A Technique is a specific approach to achieving a tactic. Each technique has a T-number: T1059 is Command and Scripting Interpreter.

A Sub-technique refines the technique: T1059.001 is PowerShell, T1059.003 is Windows Command Shell. Sub-techniques share the parent’s T-number with a decimal suffix.

Each technique entry includes:

• Plain-language description
• Known procedure examples (real-world usage by named groups)
• Detection guidance (what evidence to look for)
• Mitigation guidance
• References to source reporting

The Three Matrices

The Enterprise matrix is the most commonly used. It covers the full intrusion lifecycle from initial access through impact.

Enterprise Tactics

Reading a Technique Entry

Take T1055 — Process Injection:

• Tactic: Defense Evasion, Privilege Escalation
• Description: Adversaries inject code into other processes to evade process-based defenses and elevate privileges.
• Sub-techniques: .001 DLL Injection, .002 PE Injection, .003 Thread Execution Hijacking, .004 Asynchronous Procedure Call, .012 Process Hollowing, .013 Process Doppelgänging, and more.
• Procedure examples: lists specific malware families and APT groups observed using this technique.
• Detection: Look for CreateRemoteThread, unusual cross-process memory writes, modules loaded from unexpected paths.
• Mitigations: Privileged process protection, behavior-based AV, limited SeDebugPrivilege.

The ATT&CK Navigator

The Navigator is a web-based tool for visualizing and annotating the ATT&CK matrix. Access it at https://mitre-attack.github.io/attack-navigator/.

Core workflows:

Threat actor profiling — Load a pre-built layer for a known group (e.g., APT29, FIN7) to see which techniques they are known to use. Compare two groups to find overlap.

Incident annotation — Start a blank layer and color techniques as you find them during an investigation. Red = confirmed, yellow = suspected, green = ruled out.

Coverage gap analysis — Load your detection layer and your threat-actor layer side by side. Techniques in the actor layer but not your detection layer are blind spots.

Exporting — Layers export as JSON (for sharing) or SVG/PNG (for reports).

MITRE D3FEND

D3FEND is ATT&CK’s counterpart for defenders. Where ATT&CK catalogs what attackers do, D3FEND catalogs what defenders can do to detect, harden against, isolate, deceive, or evict threats. Each defensive technique is linked to the ATT&CK offensive techniques it counters.

Structure

D3FEND organizes defensive techniques into five top-level categories:

Example mapping:

The D3FEND knowledge base is at https://d3fend.mitre.org/.

MITRE ENGAGE

ENGAGE is a framework for adversary engagement — actively using deception, denial, and disruption to interfere with the adversary while gathering intelligence about them. It sits between pure defense (D3FEND) and offensive counter-operations.

Goals

Practical Applications

• Honeypots and honeynets: Deploy realistic-looking systems with no legitimate users. Any access is malicious by definition.
• Honeyfiles and honeytokens: Plant files with unique canary tokens embedded. When accessed or exfiltrated, an alert fires. Useful for detecting data theft and tracking where stolen data ends up.
• Credential lures: Create fake service accounts. Any login attempt using those credentials is an indicator of compromise.
• Manipulation: Feed false data to an adversary who is already inside (deception operations). Requires care and legal consideration.

ENGAGE is most relevant in mature security programs; most students will encounter it in threat intelligence and red team contexts rather than standard SOC work.

The Unified Kill Chain

The Unified Kill Chain (UKC), developed by Paul Pols (2017), merges the Lockheed Kill Chain with ATT&CK tactics into a single 18-phase model. It was designed to address the linearity problem of the original Kill Chain: real intrusions cycle through phases repeatedly and often involve multiple independent chains.

Three Macro-Phases

┌─────────────────────────────────┐
│  IN (Initial Foothold)          │  Reconnaissance through Persistence
│  THROUGH (Network Propagation)  │  Pivoting through the internal network
│  OUT (Action on Objectives)     │  Collection through Impact
└─────────────────────────────────┘

The UKC acknowledges that an adversary may complete the “IN” chain multiple times (redundant footholds), and that “THROUGH” may involve multiple waves of lateral movement before “OUT” begins.

18 Phases (abbreviated)

The UKC is less widely adopted than ATT&CK alone but is useful for threat modeling complex intrusions where a simple linear kill chain misrepresents the activity.

Applying the Frameworks

In Digital Forensics Investigations

Forensic investigations work backward: you start from artifacts and reconstruct what happened. The frameworks provide structure for that reconstruction.

Evidence → Technique → Tactic → Campaign

Evidence                          ATT&CK Annotation
─────────────────────────────     ──────────────────────────────────
Scheduled task in HKLM\...\Run   T1053.005 — Scheduled Task/Job
LSASS minidump in C:\Windows\Temp T1003.001 — LSASS Memory
Prefetch for powershell.exe       T1059.001 — PowerShell
Base64 in PowerShell ScriptBlock  T1027.010 — Obfuscated Files
DNS query for *.onion gateway     T1090.003 — Multi-hop Proxy

Timeline reconstruction by tactic: Once you have ATT&CK annotations on each artifact, group them by tactic. The temporal ordering within each tactic group reveals the attack progression.

Diamond Model integration: Each event in the timeline becomes a diamond. Pivot from the capability (malware) to infrastructure (C2 domain) to attribution (threat actor). Infrastructure overlaps between this case and prior reports are how forensic investigators link campaigns.

Reporting to non-technical stakeholders: Kill Chain phase labels translate technical findings into business-risk terms. “The attacker was in the Installation phase; they had persistence but had not yet reached lateral movement” is more useful to leadership than a list of registry keys.

In Malware Analysis

Static and dynamic analysis generate observations. ATT&CK technique IDs turn those observations into a structured, shareable report.

Build the technique list as you analyze:

Annotate in the Navigator: Color each confirmed technique. Export the layer as JSON and include it in the analysis report. This makes the report immediately comparable to other reports using the same sample family or the same threat actor.

Look up known procedure examples: Once you suspect a malware family, find it in ATT&CK’s software catalog. Every technique that family is known to use appears there. Use this to guide further analysis — if your sample is suspected Emotet and you haven’t found its persistence mechanism yet, the ATT&CK entry for Emotet tells you where to look.

Threat Intelligence Integration

ATT&CK is the lingua franca of structured threat intelligence. STIX (Structured Threat Information Expression) is the serialization format used to exchange it:

• STIX 2.1 objects represent ATT&CK techniques, threat actors, campaigns, malware, and relationships between them.
• TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol for STIX data.
• Feeds like MISP, OpenCTI, and commercial TIPs ingest STIX/TAXII and automatically link IOCs to ATT&CK techniques.

This means: a domain your malware contacted may already be tagged in a MISP instance as infrastructure for a known campaign, with all associated techniques pre-populated.

Framework Comparison

These are complementary, not competing. A complete analysis uses all of them:

• Kill Chain to describe the campaign arc
• Diamond Model to track actors and infrastructure
• ATT&CK to annotate every specific technique observed
• D3FEND to recommend what controls would have stopped each technique

Tools

Key takeaways

• Adversary models give analysts a shared vocabulary so findings correlate across cases, tools, and teams — “lateral movement” means the same thing to everyone.
• They operate at different granularities: kill chains describe the sequence of an intrusion, the Diamond Model tracks the actors and infrastructure behind each event, and ATT&CK catalogs the specific techniques used at each step. Use them together, not instead of each other.
• ATT&CK is the industry lingua franca. Tactics (the “why”) contain techniques (the “what”, e.g. T1059) which contain sub-techniques (T1059.001 PowerShell). The Enterprise matrix has 14 tactics and 200+ techniques.
• Every observation should become a technique ID: in forensics you work backward from artifacts to techniques to a campaign; in malware analysis you build the technique list forward as you reverse the sample.
• D3FEND maps defensive countermeasures back to ATT&CK techniques, and ENGAGE covers active deception — together they answer “what would have stopped this?” and “how do we turn the tables?”
• ATT&CK is the backbone of structured threat intelligence: STIX/TAXII, MISP, and OpenCTI all express techniques as ATT&CK IDs, so a domain your sample contacted may already be tagged to a known campaign.

References

• MITRE ATT&CK — the Enterprise, Mobile, and ICS matrices. https://attack.mitre.org/
• MITRE ATT&CK — Design and Philosophy (PDF). https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf
• MITRE D3FEND — defensive technique knowledge base. https://d3fend.mitre.org/
• MITRE ENGAGE — adversary engagement framework. https://engage.mitre.org/
• Hutchins, Cloppert & Amin (2011) — “Intelligence-Driven Computer Network Defense … and Intrusion Kill Chains,” Lockheed Martin. https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf
• Caltagirone, Pendergast & Betz (2013) — “The Diamond Model of Intrusion Analysis.” https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
• Pols (2021) — “The Unified Kill Chain.” https://www.unifiedkillchain.com/
• OASIS — STIX/TAXII 2.1 specifications. https://oasis-open.github.io/cti-documentation/
• A. Shostack (2014), Threat Modeling: Designing for Security, Wiley — applying these models during system design, not just post-incident.

Related course pages: Introduction to Networking · Capturing traffic with tcpdump · Analyzing traffic with Wireshark

🛠️ Maintenance note: MITRE revises ATT&CK roughly twice a year — tactic/technique counts (currently 14 Enterprise tactics, 200+ techniques) and T-numbers drift between releases, so re-verify the figures and the T1055/T1059 sub-technique lists against the live matrix each term. The Navigator URL (mitre-attack.github.io/attack-navigator) and D3FEND/ENGAGE are still maturing and occasionally restructure their categories.