What is an Attack?
Attack = Motive (Goal) + Method + Vulnerability
Every attack has three components: a reason behind it, a technique to execute it, and a weakness to exploit. Understanding this equation helps defenders prioritize by reducing opportunities across all three dimensions.
Classification of Attacks
Attacks can be broadly classified by how the attacker engages with the target:
| Attack Type | Description |
|---|---|
| Passive | Does not tamper with data — focused on intercepting and monitoring (e.g., packet sniffing) |
| Active | Tampers with data or disrupts communication (e.g., MITM, DoS) |
| Close-in Attacks | Attacker is physically nearby (e.g., shoulder surfing, eavesdropping) |
| Insider Attacks | Using privileged access to violate rules or steal data |
| Distribution Attacks | Tampering with hardware or software at the source or in transit before delivery |
What is Hacking?
Hacking is understanding a system and manipulating it in a way unexpected by its designer to make it perform actions outside of its intended purpose. More formally:
Hacking refers to exploiting system vulnerabilities and compromising security controls to gain unauthorized access to a system's resources. It involves modifying system or application features to achieve a goal outside of the creator's original purpose.
The key insight is that hacking is not random — it follows a structured methodology.
The Five-Phase Hacking Methodology
The hacking lifecycle follows five well-defined phases:
Phase 1: Footprinting and Reconnaissance
└── Passive (public records, OSINT)
└── Active (direct interaction with target)
|
Phase 2: Scanning
└── Port scanners, network mappers, vulnerability scanners
└── Gather: live machines, ports, OS, uptime
|
Phase 3: Gaining Access
└── Exploit vulnerabilities
└── Escalate privileges
|
Phase 4: Maintaining Access
└── Install backdoors, rootkits, or Trojans
└── Ensure persistent, exclusive control
|
Phase 5: Clearing Tracks
└── Clear or overwrite log files
└── Avoid detection and suspicion
Each phase builds on the previous one. Defenders who understand this sequence can implement controls at each stage to detect or disrupt the attack before it progresses.
Cyber Kill Chain Methodology
The Cyber Kill Chain is a component of intelligence-driven defense for identifying and preventing malicious intrusion activities. It maps the stages of an attack from initial planning through final objective completion.
| Stage | Description |
|---|---|
| 1. Reconnaissance | Gather data on the target to probe for weak points |
| 2. Weaponization | Create a deliverable malicious payload using an exploit and backdoor |
| 3. Delivery | Send the weaponized bundle to the victim via email, USB, web, etc. |
| 4. Exploitation | Execute code on the victim's system to exploit a vulnerability |
| 5. Installation | Install malware on the target system |
| 6. Command and Control | Establish a C2 channel to communicate and pass data |
| 7. Actions on Objectives | Perform intended actions — data theft, destruction, persistence |
Reconnaissance --> Weaponization --> Delivery --> Exploitation
|
Actions on Objectives <-- Installation <-- C2
Defenders use the Kill Chain to identify which stage an attack has reached and apply the appropriate response. The earlier in the chain an attack is detected, the less damage is done.
TTPs — Tactics, Techniques, and Procedures
TTPs describe how threat actors operate at three levels of detail:
- Tactics — the high-level guidelines describing the overall strategy from beginning to end
- Techniques — the specific technical methods used at each stage of an attack
- Procedures — the exact step-by-step actions that threat actors follow to execute an attack
TTPs are used in threat intelligence to attribute attacks, predict adversary behavior, and build targeted defenses.
MITRE ATT&CK Framework
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is one of the most widely used frameworks in the security industry.
PRE-ATT&CK
├── Reconnaissance
└── Weaponization
Enterprise ATT&CK
├── Deliver
├── Exploit
├── Control
├── Execute
└── Maintain
ATT&CK provides detailed mappings of how specific threat groups operate, enabling defenders to build detection rules and hunt for threats based on known adversary behavior rather than just indicators of compromise.
Diamond Model of Intrusion Analysis
The Diamond Model is a framework for identifying and correlating events in a security incident. It establishes that every intrusion event consists of four core features connected in a diamond relationship.
| Adversary |
Uses / \ Deployed via
/ \
Infrastructure --------- Capability
\ /
Connect \ / Exploits
to | Victim |
| Feature | Description |
|---|---|
| Adversary | The opponent behind the attack |
| Victim | The target that was exploited |
| Capability | The attack strategies and methods used |
| Infrastructure | What the adversary used to reach the victim (servers, domains, botnets) |
The Diamond Model is particularly useful for incident response analysts who need to connect related events, identify attacker infrastructure, and build a complete picture of an intrusion campaign.
Why These Frameworks Matter
Using structured frameworks like the Kill Chain, MITRE ATT&CK, and the Diamond Model enables security teams to:
- Move from reactive alert response to proactive threat hunting
- Attribute incidents to known threat actor groups
- Identify gaps in detection coverage across attack stages
- Prioritize defenses based on the techniques most likely to be used against their specific environment
Without frameworks, defenders are forced to treat each incident in isolation. With them, individual events become part of a broader, interpretable pattern.