The Diamond Model of Intrusion Analysis — Cyber Threat Intelligence

Frameworks like the kill chain and MITRE ATT&CK are brilliant at describing what an attacker does and in what order. But an investigation also needs to capture how the pieces of an attack relate: who is behind it, what tool they used, where it came from, and whom it hit. The Diamond Model of Intrusion Analysis, published in 2013 by researchers Sergio Caltagirone, Andrew Pendergast, and Christopher Betz, is a simple, durable way to record exactly those relationships — and to turn a single clue into a fuller picture of an intrusion.

What the Diamond Model is

The Diamond Model describes any malicious event as a link between four core features: an adversary, a capability, some infrastructure, and a victim. Draw those four as the points of a diamond, connect them, and you have a compact record of a single event — one step in an intrusion.

Its value is not the picture but the discipline. By forcing every event into the same four slots, it makes analysts state what they know and, just as importantly, what they don't. A blank corner is a research question, not a gap to paper over.

📌

One event, four features. The Diamond captures a single malicious event as the relationship between an adversary, a capability, infrastructure, and a victim.

The four corners

Each corner answers a different question. The adversary is who is behind the activity — a person or group, often unknown at first. The capability is what they use: the malware, exploit, or technique. The infrastructure is where it operates from: the servers, domains, and addresses used to deliver the capability and control it. The victim is whom it targets — an organization, a system, a person.

Two natural axes run through the diamond. The line between adversary and victim is the social and political relationship — motive and target. The line between capability and infrastructure is the technical relationship — the machinery of the attack. Keeping both in view stops an investigation from becoming purely technical or purely strategic.

A malicious event links an adversary and a victim through a capability delivered over infrastructure.

Pivoting: one clue leads to the rest

The reason the model earns its keep is pivoting. Because the four corners are connected, knowing one lets you hunt for the others. Find a malicious internet address (infrastructure) and you can look for the malware it served (capability). Identify the malware and you may recognize the group that builds it (adversary). Know the adversary's habits and you can find other organizations hit the same way (more victims).

Each pivot turns a single, isolated indicator into a thread you can pull. An investigation becomes a loop of asking, for every fact you have, what it connects to next — filling in the diamond one corner at a time.

Because the corners are linked, one indicator leads an analyst to discover the next.

How it fits with kill chain and ATT&CK

The Diamond Model does not replace the kill chain or MITRE ATT&CK — the public knowledge base of adversary techniques — it complements them. Those frameworks answer what happened and in what order: the stages of an attack and the specific techniques used. The Diamond answers who relates to whom: the connections between the players and their machinery.

Used together, they are powerful. A kill-chain stage tells you where in an attack you are; an ATT&CK technique tells you the method; a Diamond event records the adversary, capability, infrastructure, and victim bound up in that step. One gives you the timeline, the other gives you the relationships.

Stage-based frameworks describe what and when; the Diamond describes who relates to whom.

A Diamond for an agent intrusion

The model maps cleanly onto attacks on AI systems. Consider an AI agent — software that uses a model to take real actions like fetching web pages or calling tools — that is compromised through a manipulated instruction hidden in content it reads. The adversary is whoever planted it; the capability is the injection technique; the infrastructure is the web page or service hosting the poisoned content; the victim is the agent and the systems it can touch.

Recording an AI incident this way brings the same benefits. A blank adversary corner becomes a hunt; a known malicious page (infrastructure) can be pivoted to find other agents that fetched it. The subject is new, but the four corners — and the discipline of connecting them — are exactly the same.

An attack on an AI agent fills the same four corners as any other intrusion.

Key takeaways

The Diamond Model records a malicious event as the link between an adversary, a capability, infrastructure, and a victim.
It captures relationships — who relates to whom — rather than the stages a stage-based framework describes.
Its power is pivoting: knowing one corner lets you hunt for the others and turn a single clue into a full picture.
It complements the kill chain and MITRE ATT&CK rather than replacing them — timeline plus relationships.
A blank corner is a research question, which keeps an investigation honest about what is known and unknown.
It maps cleanly onto AI-agent intrusions: adversary, injection capability, poisoned infrastructure, and the agent as victim.

Glossary

Diamond Model: A model that records a malicious event as the relationship between an adversary, a capability, infrastructure, and a victim.
Adversary: The person or group behind an intrusion — often unknown at the start of an investigation.
Capability: What the adversary uses to act: the malware, exploit, or technique.
Infrastructure: The servers, domains, and addresses used to deliver a capability and control it.
Pivoting: Using one known corner of the diamond to discover another, turning a single clue into a fuller picture.