Analysis Frameworks.md

Different ways of analyzing, categorizing, and theorizing about cyberattacks

Cyber Kill Chain

• Developed by Lockheed Martin
• Breaks attacks into seven steps:
  1. Reconnaissance
  2. Weaponization
  3. Delivery
  4. Exploitation
  5. Installation
  6. Command and Control
  7. Actions on Objectives

MITRE ATT&CK framework

• Adversarial Tactics, Techniques, and Common Knowledge
• matrix of tactics and techniques, not an ordered set of steps
• complementary to Lockheed's cyber kill chain
• Developed by MITRE, a non-profit organization
  • MITRE also maintains CVE system and CWE (Common Weakness Enumeration) project

Diamond model of intrusion analysis

• defines attacks by four terms in mutual relationship:
  • Adversary, Capability, Infrastructure, Victim
• can reveal similarities in different attacks