Diamond Model
🧠 What is the Diamond Model?
Diamond Model adalah sebuah kerangka analisis ancaman siber yang menjelaskan serangan siber melalui hubungan antara empat fitur utama (core features). Model ini berguna untuk:
- Memahami peristiwa intrusi
- Mengidentifikasi pola dan pelaku ancaman
- Mendukung intelijen ancaman dan respons insiden
🔥 Core Features (Wajib Ada)
Setiap intrusion digambarkan pakai 4 komponen utama:
🧌 Adversary
- Aktor/organisasi yang melakukan serangan
- Bisa dibagi jadi:
- Adversary Operator: Eksekutor/hacker-nya langsung
- Adversary Customer: Pihak yang nyuruh/dapat keuntungan
🖥️ Infrastructure
- Sistem & koneksi yang dipakai untuk menyampaikan serangan
- Contoh: domain, C2 server, IP, USB, email
- Jenis:
- Type 1: Dikontrol langsung oleh attacker
- Type 2: Lewat pihak ketiga/kompromi, untuk obfuscation
🔨 Capability
- Tools, malware, atau teknik yang digunakan buat nyerang
- Contoh: exploit kit, phishing email, ransomware
🎯 Victim
- Target dari serangan
- Tipe:
- Victim Personae: Orang/organisasi yang disasar
- Victim Assets: Sistem/email/IP yang jadi target
✨ Meta-Features (Opsional tapi Keren)
⏱️ Timestamp
- Waktu kejadian (mulai & selesai)
- Bantu identifikasi pola waktu serangan (misal zona waktu attacker)
📈 Phase
Tahapan serangan berdasarkan kill chain:
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command & Control (C2)
- Actions on Objective
✅ Result
- Hasil dari serangan:
- Success / Failure / Unknown
- Bisa kaitkan ke CIA Triad:
- Confidentiality Compromised
- Integrity Compromised
- Availability Compromised
🔁 Direction
Arah komunikasi:
- Victim → Infra
- Infra → Victim
- Infra → Infra
- Adversary → Infra
- Infra → Adversary
- Bidirectional / Unknown
🧪 Methodology
Tipe serangan: phishing, DDoS, port scan, malware delivery, dll
📦 Resources
Sumber daya eksternal yang dipakai buat ngejalanin serangan:
- Software (e.g. Metasploit)
- Knowledge (cara pakai exploit)
- Hardware (server, router)
- Funds (beli domain)
- Access (jaringan target)
🧠 Extra Components
🌍 Social-Political
Motivasi & tujuan serangan: Hacktivism, espionage, financial gain, bragging rights
Contoh: nyerang perusahaan buat jadi zombie crypto miner
🧨 Technology
Hubungan antara capability dan infrastructure
Contoh: watering-hole attack → compromised website dikunjungi victim
💡 Use Cases
- Threat Hunting 🕵️♂️
- CTI (Cyber Threat Intelligence) Reports 📊
- Attribution 🎯
- Incident Response 🚨
- IOC Mapping & Correlation 🔗
🧃 TL;DR Table
🔷 Core Features
| Feature | Example |
|---|---|
| Adversary | APT29 (Advanced Persistent Threat) |
| Infrastructure | C2 Server → `evil[.]com` |
| Capability | Emotet Malware, Spearphishing |
| Victim | Employee at Oil & Gas Company |
✨ Meta-Features
| Meta-Feature | Example |
|---|---|
| Timestamp | 2025-05-12 03:34 UTC |
| Phase | Exploitation → C2 → Data Exfiltration |
| Result | Success – Confidentiality Compromised |
| Direction | Infra → Victim |
| Methodology | Phishing Email with Payload |
| Resources | Metasploit, stolen creds, SMTP infrastructure |
| Technology | Malware beacon via HTTPS |
| Social-Political | Financial Gain – Data Sold in Dark Web |