https://wiki.haidhi.my.id/wiki/index.php?action=history&feed=atom&title=Diamond_Model 2026-11-01T22:42:51Z Revision history for this page on the wiki MediaWiki 1.43.0 https://wiki.haidhi.my.id/wiki/index.php?title=Diamond_Model&diff=348&oldid=prev 2025-05-13T04:12:23Z

<p>Created page with &quot;== 🧠 What is the Diamond Model? == Diamond Model adalah sebuah kerangka analisis ancaman siber yang menjelaskan serangan siber melalui hubungan antara empat fitur utama (core features). Model ini berguna untuk: *Memahami peristiwa intrusi *Mengidentifikasi pola dan pelaku ancaman *Mendukung intelijen ancaman dan respons insiden == 🔥 Core Features (Wajib Ada) == Setiap intrusion digambarkan pakai 4 komponen utama: === 🧌 Adversary === *Aktor/organisasi yang me...&quot;</p> <p><b>New page</b></p><div>== 🧠 What is the Diamond Model? ==<br /> Diamond Model adalah sebuah kerangka analisis ancaman siber yang menjelaskan serangan siber <br /> melalui hubungan antara empat fitur utama (core features). Model ini berguna untuk:<br /> *Memahami peristiwa intrusi<br /> *Mengidentifikasi pola dan pelaku ancaman<br /> *Mendukung intelijen ancaman dan respons insiden<br /> <br /> == 🔥 Core Features (Wajib Ada) ==<br /> <br /> Setiap intrusion digambarkan pakai 4 komponen utama:<br /> <br /> === 🧌 Adversary ===<br /> *Aktor/organisasi yang melakukan serangan<br /> *Bisa dibagi jadi:<br /> **&#039;&#039;&#039;Adversary Operator&#039;&#039;&#039;: Eksekutor/hacker-nya langsung<br /> **&#039;&#039;&#039;Adversary Customer&#039;&#039;&#039;: Pihak yang nyuruh/dapat keuntungan<br /> <br /> === 🖥️ Infrastructure ===<br /> *Sistem &amp; koneksi yang dipakai untuk menyampaikan serangan<br /> *Contoh: domain, C2 server, IP, USB, email<br /> *Jenis:<br /> **&#039;&#039;Type 1&#039;&#039;: Dikontrol langsung oleh attacker<br /> **&#039;&#039;Type 2&#039;&#039;: Lewat pihak ketiga/kompromi, untuk obfuscation<br /> <br /> === 🔨 Capability ===<br /> *Tools, malware, atau teknik yang digunakan buat nyerang<br /> *Contoh: exploit kit, phishing email, ransomware<br /> <br /> === 🎯 Victim ===<br /> *Target dari serangan<br /> *Tipe:<br /> **&#039;&#039;Victim Personae&#039;&#039;: Orang/organisasi yang disasar<br /> **&#039;&#039;Victim Assets&#039;&#039;: Sistem/email/IP yang jadi target<br /> <br /> == ✨ Meta-Features (Opsional tapi Keren) ==<br /> <br /> === ⏱️ Timestamp ===<br /> *Waktu kejadian (mulai &amp; selesai)<br /> *Bantu identifikasi pola waktu serangan (misal zona waktu attacker)<br /> <br /> === 📈 Phase ===<br /> Tahapan serangan berdasarkan kill chain:<br /> #Reconnaissance<br /> #Weaponization<br /> #Delivery<br /> #Exploitation<br /> #Installation<br /> #Command &amp; Control (C2)<br /> #Actions on Objective<br /> <br /> === ✅ Result ===<br /> *Hasil dari serangan:<br /> **Success / Failure / Unknown<br /> **Bisa kaitkan ke CIA Triad:<br /> ***Confidentiality Compromised<br /> ***Integrity Compromised<br /> ***Availability Compromised<br /> <br /> === 🔁 Direction ===<br /> Arah komunikasi:<br /> *Victim → Infra<br /> *Infra → Victim<br /> *Infra → Infra<br /> *Adversary → Infra<br /> *Infra → Adversary<br /> *Bidirectional / Unknown<br /> <br /> === 🧪 Methodology ===<br /> Tipe serangan: phishing, DDoS, port scan, malware delivery, dll<br /> <br /> === 📦 Resources ===<br /> Sumber daya eksternal yang dipakai buat ngejalanin serangan:<br /> *Software (e.g. Metasploit)<br /> *Knowledge (cara pakai exploit)<br /> *Hardware (server, router)<br /> *Funds (beli domain)<br /> *Access (jaringan target)<br /> <br /> <br /> == 🧠 Extra Components ==<br /> <br /> === 🌍 Social-Political ===<br /> Motivasi &amp; tujuan serangan: Hacktivism, espionage, financial gain, bragging rights &lt;br&gt;<br /> Contoh: nyerang perusahaan buat jadi zombie crypto miner<br /> <br /> === 🧨 Technology ===<br /> Hubungan antara capability dan infrastructure &lt;br&gt;<br /> Contoh: watering-hole attack → compromised website dikunjungi victim<br /> <br /> == 💡 Use Cases == <br /> *Threat Hunting 🕵️‍♂️<br /> *CTI (Cyber Threat Intelligence) Reports 📊<br /> *Attribution 🎯<br /> *Incident Response 🚨<br /> *IOC Mapping &amp; Correlation 🔗<br /> <br /> <br /> == 🧃 TL;DR Table == <br /> <br /> === 🔷 Core Features ===<br /> <br /> {| class=&quot;wikitable&quot; style=&quot;margin:auto; float:left&quot;<br /> |-<br /> ! Feature !! Example<br /> |-<br /> | Adversary || APT29 (Advanced Persistent Threat) <br /> |-<br /> | Infrastructure || C2 Server → `evil[.]com`<br /> |-<br /> | Capability || Emotet Malware, Spearphishing<br /> |-<br /> | Victim || Employee at Oil &amp; Gas Company<br /> |}<br /> &lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;<br /> <br /> === ✨ Meta-Features ===<br /> <br /> {| class=&quot;wikitable&quot; style=&quot;margin:auto; float:left&quot;<br /> |-<br /> ! Meta-Feature !! Example<br /> |-<br /> | Timestamp || 2025-05-12 03:34 UTC<br /> |-<br /> | Phase || Exploitation → C2 → Data Exfiltration <br /> |-<br /> | Result || Success – Confidentiality Compromised <br /> |-<br /> | Direction || Infra → Victim <br /> |-<br /> | Methodology || Phishing Email with Payload <br /> |-<br /> | Resources || Metasploit, stolen creds, SMTP infrastructure <br /> |-<br /> | Technology || Malware beacon via HTTPS <br /> |-<br /> | Social-Political || Financial Gain – Data Sold in Dark Web <br /> |}</div>

SanzSkuy