Threat Intelligence Frameworks and Standards
This domain tests whether you can pick the right framework for a task: describing an intrusion, mapping detection coverage, pivoting between artefacts, or exchanging data between tools.
Lockheed Martin Cyber Kill Chain
Seven phases: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives. Good for segmenting an intrusion narrative and placing controls; weak for non-linear activity, insider cases, and it does not enumerate behaviours in enough detail to write detections.
MITRE ATT&CK
A knowledge base of adversary tactics (the why - matrix columns) and techniques with sub-techniques (the how), linked to groups, software and procedures. Matrices exist for Enterprise, Mobile and ICS. Uses: detection coverage mapping, hunt planning, gap analysis, and a shared vocabulary in reports. ATT&CK is behaviour-based; it is not an attribution tool and not a checklist to maximise.
Diamond Model
Four vertices - adversary, capability, infrastructure, victim - with social-political and technical axes. Its value is pivoting: knowledge of any vertex leads toward the others, which is how you move from a single indicator to a campaign.
Pyramid of Pain
Hash values → IP addresses → domain names → network/host artefacts → tools → TTPs. The higher you detect, the more the adversary must change, and the longer the detection survives.
Sharing and data standards
- STIX 2.x - JSON data model (indicators, observables, actors, relationships, sightings).
- TAXII 2.1 - HTTPS transport for STIX collections and channels.
- MISP - sharing platform and format with events, attributes, taxonomies and feeds.
- Sigma - vendor-neutral detection rule format; YARA - file and memory signature rules; OpenIOC - legacy indicator format.
- CVE/CVSS for vulnerabilities, CAPEC for attack patterns, VERIS for incident taxonomy, NIST SP 800-150 for sharing guidance, TLP for handling.
Worked example
You must detect an actor using a renamed legitimate Windows utility. Reasoning: a file hash sits at the base of the pyramid and fails on recompilation. The behaviour maps to ATT&CK masquerading and system-binary proxy execution, which are capability vertices in the Diamond Model. Write a Sigma rule on the parent-child process relationship, tag it with the ATT&CK technique IDs, and share it as a STIX indicator plus ATT&CK reference. The detection survives the hash change and other teams can consume it.
Traps that cost marks
- Treating ATT&CK coverage percentage as a score to maximise; it hides detection quality.
- Using the kill chain as the whole detection model with no behaviours.
- Confusing STIX (data model) with TAXII (transport).
- Using CVSS alone as a prioritisation signal - it measures severity, not exploitation likelihood.