View source for Diamond Model

== 🧠 What is the Diamond Model? ==
Diamond Model adalah sebuah kerangka analisis ancaman siber yang menjelaskan serangan siber 
melalui hubungan antara empat fitur utama (core features). Model ini berguna untuk:
*Memahami peristiwa intrusi
*Mengidentifikasi pola dan pelaku ancaman
*Mendukung intelijen ancaman dan respons insiden

== 🔥 Core Features (Wajib Ada) ==

Setiap intrusion digambarkan pakai 4 komponen utama:

=== 🧌 Adversary ===
*Aktor/organisasi yang melakukan serangan
*Bisa dibagi jadi:
**'''Adversary Operator''': Eksekutor/hacker-nya langsung
**'''Adversary Customer''': Pihak yang nyuruh/dapat keuntungan

=== 🖥️ Infrastructure ===
*Sistem & koneksi yang dipakai untuk menyampaikan serangan
*Contoh: domain, C2 server, IP, USB, email
*Jenis:
**''Type 1'': Dikontrol langsung oleh attacker
**''Type 2'': Lewat pihak ketiga/kompromi, untuk obfuscation

=== 🔨 Capability ===
*Tools, malware, atau teknik yang digunakan buat nyerang
*Contoh: exploit kit, phishing email, ransomware

=== 🎯 Victim ===
*Target dari serangan
*Tipe:
**''Victim Personae'': Orang/organisasi yang disasar
**''Victim Assets'': Sistem/email/IP yang jadi target

== ✨ Meta-Features (Opsional tapi Keren) ==

=== ⏱️ Timestamp ===
*Waktu kejadian (mulai & selesai)
*Bantu identifikasi pola waktu serangan (misal zona waktu attacker)

=== 📈 Phase ===
Tahapan serangan berdasarkan kill chain:
#Reconnaissance
#Weaponization
#Delivery
#Exploitation
#Installation
#Command & Control (C2)
#Actions on Objective

=== ✅ Result ===
*Hasil dari serangan:
**Success / Failure / Unknown
**Bisa kaitkan ke CIA Triad:
***Confidentiality Compromised
***Integrity Compromised
***Availability Compromised

=== 🔁 Direction ===
Arah komunikasi:
*Victim → Infra
*Infra → Victim
*Infra → Infra
*Adversary → Infra
*Infra → Adversary
*Bidirectional / Unknown

=== 🧪 Methodology ===
Tipe serangan: phishing, DDoS, port scan, malware delivery, dll

=== 📦 Resources ===
Sumber daya eksternal yang dipakai buat ngejalanin serangan:
*Software (e.g. Metasploit)
*Knowledge (cara pakai exploit)
*Hardware (server, router)
*Funds (beli domain)
*Access (jaringan target)


== 🧠 Extra Components ==

=== 🌍 Social-Political ===
Motivasi & tujuan serangan: Hacktivism, espionage, financial gain, bragging rights <br>
Contoh: nyerang perusahaan buat jadi zombie crypto miner

=== 🧨 Technology ===
Hubungan antara capability dan infrastructure <br>
Contoh: watering-hole attack → compromised website dikunjungi victim

== 💡 Use Cases == 
*Threat Hunting 🕵️‍♂️
*CTI (Cyber Threat Intelligence) Reports 📊
*Attribution 🎯
*Incident Response 🚨
*IOC Mapping & Correlation 🔗


== 🧃 TL;DR Table == 

=== 🔷 Core Features ===

{| class="wikitable" style="margin:auto; float:left"
|-
! Feature !! Example
|-
| Adversary || APT29 (Advanced Persistent Threat)  
|-
| Infrastructure || C2 Server → `evil[.]com`
|-
| Capability || Emotet Malware, Spearphishing
|-
| Victim || Employee at Oil & Gas Company
|}
<br><br><br><br><br><br>

=== ✨ Meta-Features ===

{| class="wikitable" style="margin:auto; float:left"
|-
! Meta-Feature !! Example
|-
| Timestamp || 2025-05-12 03:34 UTC
|-
| Phase || Exploitation → C2 → Data Exfiltration 
|-
| Result || Success – Confidentiality Compromised            
|-
| Direction || Infra → Victim                                   
|-
| Methodology || Phishing Email with Payload                      
|-
| Resources || Metasploit, stolen creds, SMTP infrastructure    
|-
| Technology || Malware beacon via HTTPS                         
|-
| Social-Political || Financial Gain – Data Sold in Dark Web     
|}