Reading the Adversary: TTPs, the Diamond Model and Attribution
What is it?
Reading the adversary means characterising who is behind an intrusion from how they operate. TTPs (tactics, techniques and procedures) are their behavioural fingerprint; the Diamond Model organises an event into four linked vertices — adversary, capability, infrastructure, victim; and attribution is the reasoned, confidence-rated claim that a set of activity belongs to a known actor. It is judgement under uncertainty, not certainty.
Why it matters
Knowing the actor lets you anticipate: if activity matches a group that always follows initial access with a specific persistence and a specific C2, you can hunt for the next step before it happens. But attribution is where analysts most often overreach — shared tools and deliberate false flags mislead the careless. Getting the confidence right is as important as the claim.
Where you see it
TTPs are read from the same evidence you already gather — process ancestry, persistence, network behaviour — and mapped to MITRE ATT&CK groups. Diamond vertices are populated from the incident: the malware (capability), the C2 domains and servers (infrastructure), the targeted host or sector (victim), and the inferred operator (adversary). Attribution draws on all of it plus external reporting.
What normal looks like
A sound attribution links multiple durable, hard-to-fake signals: reused custom infrastructure, distinctive tooling the group is known to author, and a consistent TTP chain across campaigns — and it states a confidence level and the evidence behind it. Confidence rises as independent signals converge.
What suspicious looks like
A weak or dangerous attribution rests on a single, easily-shared signal: 'they used a common open-source RAT, so it must be Group X'. Anyone can use a public tool, and sophisticated actors plant false flags — foreign-language strings, another group's tooling — precisely to misdirect. A confident claim on thin, fakeable evidence is the classic trap.
How analysts investigate
Map the observed TTPs to candidate groups, populate the Diamond vertices, and weigh each attribution signal by how hard it is to fake. Prefer durable, distinctive signals (custom tooling, reused private infrastructure, a full TTP chain) over shared ones (a public tool, a common port). State a confidence level and name what would change it — never assert certainty the evidence cannot bear.
Common beginner mistakes
- Attributing to a group on a single shared signal, such as a common open-source tool.
- Taking a false flag (a planted foreign string, another group's tool) at face value.
- Stating attribution as certainty instead of a confidence-rated judgement.
What you will be able to do
- Map observed TTPs to candidate threat groups.
- Populate the four vertices of the Diamond Model from an incident.
- Rate attribution confidence and resist shared-signal and false-flag traps.
Indicators change; behaviour is sticky. A group can swap every hash and IP overnight, but the way it operates — how it gains access, persists, moves and exfiltrates — is expensive to change and tends to repeat across victims. That behavioural fingerprint is what links today's incident to a known actor, and the Diamond Model is the frame that keeps the reasoning honest.
ADVERSARY
(who: the operator)
/ \
/ \
CAPABILITY <------> INFRASTRUCTURE
(malware, tools) (C2 domains, servers)
\ /
\ /
VICTIM
(host, org, sector)Step by step: (1) list the observed TTPs and map them to candidate ATT&CK groups; (2) fill the Diamond — capability (the malware family), infrastructure (the C2), victim (the host/sector), adversary (the inferred operator); (3) weigh each attribution signal by how hard it is to fake; (4) state a confidence level and what evidence would raise or lower it.
Worked example — how confident is the attribution?
| Attribution signal | How hard to fake | Weight |
|---|---|---|
| Used a common open-source RAT | Trivial — anyone can | Very low |
| Reused a private C2 domain seen in prior FIN-native ops | Hard | High |
| Same full TTP chain across three campaigns | Hard | High |
Before reading on, decide how much confidence these three signals together justify. The answer: moderate-to-high, but only because of the last two. The open-source RAT is worthless for attribution — anyone can download it, and a false flag would happily use it. The reused private infrastructure and the repeated full TTP chain are hard to fake and specific to the group, and two independent durable signals converging is what earns real confidence. Note what you did: you discounted the shared signal and leaned on the distinctive ones — and you stated a level, not a certainty.
Recap
- Behaviour (TTPs) is the durable fingerprint; indicators change, tradecraft repeats.
- The Diamond Model links adversary, capability, infrastructure and victim.
- Weight attribution signals by how hard they are to fake; state confidence, never certainty.
Sign in to save your progress on the server.