What is Diamond Model of Intrusion Analysis?

Sergio Caltagirone, Andrew Pendergast and Christopher Betz published the model in 2013, in a paper approved for public release. The paper starts from the question "What is the underlying method to our work?" and its answer is the event, the smallest unit of intrusion activity. Everything else in the model (activity threads, activity-attack graphs, activity groups) is built out of events.

It is unrelated to Porter's Diamond, the economics model of national competitive advantage. Searches for "diamond model" mix the two.

The four core features

• Adversary: the actor responsible for using the capability against the victim. The paper expects this feature to be empty for most events when they are first discovered.
• Capability: the tools and techniques used, from manual password guessing to automated exploitation. Command and control is a sub-feature of capability, because the malware decides how it talks home. Everything one capability can exploit is its capacity; all of an adversary's capabilities together are its arsenal.
• Infrastructure: the physical or logical structures used to deliver the capability, keep control of it and get results out, such as IP addresses, domains and email addresses. Type 1 is owned or controlled by the adversary. Type 2 is controlled by an intermediary, witting or not: compromised hosts, staging servers, malicious domains, hijacked mailboxes. Type 2 is usually what the victim sees. Service providers (ISPs, registrars, webmail) keep both types running.
• Victim: split into the persona (people, organizations, industries, job roles) and the assets (networks, hosts, email addresses, accounts). A victim asset in one event can become infrastructure in the next, so the apparent target is not always the victim.

The paper defines five edges: adversary to capability, adversary to infrastructure, infrastructure to capability, infrastructure to victim and capability to victim. There is no direct adversary to victim edge. That relationship lives in the social-political meta-feature. Each edge is a pivot you can try, and each feature you cannot fill is a knowledge gap the model makes visible on purpose.

Meta-features

Every feature, core or meta, carries its own confidence value. The paper leaves the scale undefined so each team can pick its own.

The extended Diamond adds two more. Social-political runs across the adversary-victim axis: the adversary's needs (income, espionage, publicity) and the victim's ability to satisfy them. Intent sits here. Technology runs across the capability-infrastructure axis. Malware that resolves a domain and talks HTTP depends on IP, TCP, HTTP and DNS, and watching for misuse of those protocols finds new activity whatever the tool or server.

The seven axioms

The paper numbers seven axioms and adds one corollary:

1. Every intrusion event has an adversary taking a step toward a goal by using a capability over infrastructure against a victim to produce a result.
2. There is a set of adversaries (insiders, outsiders, individuals, groups, organizations) trying to compromise systems to further their intent.
3. Every system, and so every victim asset, has vulnerabilities and exposures.
4. Every malicious activity has two or more phases that must succeed in succession.
5. Every intrusion event needs one or more external resources before it can succeed.
6. A relationship always exists between an adversary and its victims, even if distant, fleeting or indirect.
7. Some adversaries have the motivation, resources and capabilities to sustain effects against a victim for a long time while resisting mitigation. These are persistent adversary relationships.

The corollary says persistence comes in degrees, from fleeting to enduring. On shift, Axiom 4 is the useful one, because a C2 alert means a delivery event happened earlier, whether or not you logged it.

Walking one C2 domain around the diamond

A simulated incident generated by SOCSimulator Research. Hosts, users, the domain, the IP and the file names are invented: the domain uses the reserved .example top-level domain and the address comes from the 203.0.113.0/24 documentation range. The queries use column names from Microsoft's Defender XDR advanced hunting schema; SOCSimulator has not run them against a live tenant.

Victim to Capability. An EDR alert fires on FIN-WS-0412: outlook.exe started rundll32.exe, which loaded rptsync.dll from the user's AppData folder. The host is a victim asset and the DLL is the capability.

Capability to Infrastructure. Sandbox output for the DLL shows HTTPS beacons to sync.reportcdn.example, which resolves to 203.0.113.47. This is the capability to infrastructure edge: the C2 configuration names the server.

Infrastructure to Victim. Who else talked to it?

// Every device that reached the C2 domain or its IP in 30 days
let c2Domain = "sync.reportcdn.example";
let c2Ip = "203.0.113.47";
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has c2Domain or RemoteIP == c2Ip
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Connections = count()
    by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
| sort by FirstSeen asc

In the example it returns three devices. FIN-WS-0412 and FIN-WS-0388 beacon from rundll32.exe. HR-WS-0107 beacons from msedgeupd.exe with a different hash: a second capability on the same infrastructure.

Victim to Capability, again. What started the process that made each connection? Matching on process ID plus creation time keeps a reused PID from joining the wrong process.

let beacons = DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl has "sync.reportcdn.example" or RemoteIP == "203.0.113.47"
    | distinct DeviceId, InitiatingProcessId, InitiatingProcessCreationTime;
DeviceProcessEvents
| where Timestamp > ago(30d)
| join kind=inner (beacons) on $left.DeviceId == $right.DeviceId,
    $left.ProcessId == $right.InitiatingProcessId,
    $left.ProcessCreationTime == $right.InitiatingProcessCreationTime
| project Timestamp, DeviceName, FileName, SHA256, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName

On the two finance hosts the parent chain goes back to Outlook. On HR-WS-0107 the parent is wscript.exe running a script from the Downloads folder. Same infrastructure, different delivery method.

Infrastructure to Infrastructure. What else lives on that IP?

DeviceNetworkEvents
| where Timestamp > ago(30d) and RemoteIP == "203.0.113.47"
| summarize Devices = dcount(DeviceId), FirstSeen = min(Timestamp) by RemoteUrl
| sort by FirstSeen asc

A second name, cdn.mailstat.example, shows up on FIN-WS-0388 two days before the first alert. Before you treat it as the same adversary, check whether the IP is shared hosting or a CDN. The paper warns that shared hosting and public tools are how unrelated activity ends up clustered together.

Adversary. Nothing in this telemetry names one. The model records the empty feature as a gap and moves on. The paper's pivot toward the adversary is registration data for the IP or the domain, with the caveat that registrants often lie, though a fake persona reused across domains can still link events.

Without Defender for Endpoint, Sysmon gives you the same pivot. Event ID 22 logs DNS queries along with the process that made them, from Windows 8.1 on. Event ID 3 logs TCP and UDP connections and links each one to its process through ProcessId and ProcessGuid, but it is disabled by default. Check the Sysmon config before you conclude that a host never talked to the domain.

From one diamond to an activity thread

An activity thread is a directed graph of events ordered by phase, one thread per adversary-victim pair. Each arc is a causal link labeled with its confidence, whether it is necessary (AND) or one of several paths (OR), whether it is actual or hypothesized, and what the earlier event provided to the later one. The example produces two threads:

Filling gaps inside one thread is vertical correlation: the hypothesized delivery row tells you which log to pull next, and the HR thread still has no delivery event at all. Linking threads across victims is horizontal correlation: the shared domain links the finance and HR threads, and the earlier cdn.mailstat.example traffic suggests FIN-WS-0412 was not the first victim.

An activity-attack graph overlays threads on a traditional attack graph. The attack graph lists the paths an adversary could take; the threads show the paths it did take. Here, the HR thread shows the email filter is not the only path to close.

Activity groups are sets of events and threads that share features, built in six steps: define the analytic problem, select features, create the groups, grow them as new events arrive, analyze them and redefine them from time to time. The paper names overfitting as the main risk, which is why the shared-hosting check above matters.

Where the Kill Chain and ATT&CK fit

The paper calls the Diamond Model and Kill Chain analysis highly complementary. Its activity thread figure uses the Kill Chain phases from reconnaissance to actions on objectives, and it builds a Kill Chain course of action matrix from two threads, so one mitigation can cover several victims. The phase model is pluggable, though: any model with at least two ordered phases satisfies Axiom 4.

MITRE ATT&CK came after the paper; v20 has been the current release since 13 October 2026. Technique IDs describe the capability and fit the methodology meta-feature, which the authors designed to take an existing taxonomy (they suggest Snort classtypes). In the example, the delivery row is T1566.001 Spearphishing Attachment and the C2 rows are T1071.001 Web Protocols. ATT&CK says how the adversary acted; the diamond records who, over what infrastructure, against whom, and how one event led to the next.

Adversary-Operator and Adversary-Customer

The operator is whoever runs the intrusion. The customer is whoever benefits, and may or may not be the same party. The paper's example is a well-resourced customer directing several operators, each with its own capabilities and infrastructure, against a common victim. Two clusters with different tooling against the same victims are not proof of two different sponsors. The paper models that case as activity group families.