What is Diamond Model?

Developed by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz and published through the US Department of Defense, the Diamond Model gives analysts a repeatable schema for describing a single intrusion event, and a method for connecting many events into a campaign. The four vertices sit at the corners of a diamond: Adversary (the actor's identity, if known, along with motivation and intent), Capability (the malware, exploits, and tools used), Infrastructure (the IPs, domains, hosting providers, and C2 servers), and Victim (the targeted organization, system, or data). Meta-features around the diamond, timestamp, phase (mapping loosely to kill chain stages), result, and direction, add context to each event.

The model's value is in pivoting. Start with a malware sample (Capability), extract the C2 domains it communicates with (Infrastructure), then search historical data for every other victim that saw traffic to that same infrastructure (Victim), and the pattern across those victims starts to reveal who the Adversary is likely targeting and why. Analysts chain multiple diamonds together, linking one intrusion event's infrastructure to the next event's capability, to build an activity thread showing a campaign's evolution over time.

Where MITRE ATT&CK catalogs what techniques an adversary used, the Diamond Model provides the relational structure for connecting those techniques back to a specific actor and campaign across multiple incidents, which is why the two frameworks are typically used together rather than as alternatives: ATT&CK for the how, Diamond for the who and the connections between events.

The model also formalizes the Adversary vertex into two distinct roles that are easy to conflate: the Adversary-Operator (the individual or team physically running the intrusion, hands on keyboard) and the Adversary-Customer (whoever benefits from the operation, which in a nation-state or ransomware-affiliate context can be a different party than the operator). Separating the two prevents analysts from mistaking an infrastructure-for-hire provider for the actual sponsoring actor, a distinction that matters for attribution and for anticipating what the adversary wants next.