CySA+ v4 · Objective 3.1

Attack methodology frameworks

Use the Cyber Kill Chain, Diamond Model, and MITRE ATT&CK to explain an intrusion, identify missing evidence, and choose the next defensive question.

What you will be able to do

  • Distinguish intrusion stages, event relationships, and observed adversary behaviours.
  • Map a supported observation to a framework without inventing missing activity.
  • Turn a framework gap into a specific collection or detection task.
  • Separate infrastructure overlap from evidence of common ownership.

Learn the concepts

  1. Lesson 1

    Choose the model that answers your question

    A framework organises evidence; it does not manufacture it. Learn to select a model that supports the decision you need to make, while keeping observations separate from your interpretation.

    Open lesson →
  2. Lesson 2

    Build a map that leads to useful action

    A useful framework map ends with a decision or a collection task. This lesson turns a handful of uncertain observations into a clear investigation plan and a realistic detection improvement.

    Open lesson →

Apply your judgement · Synthetic scenario

The unfamiliar maintenance task

At a fictional design cooperative, an analyst finds an unapproved scheduled task on a rendering workstation. The task connects to a relay service also present in an unrelated threat report. The team must describe the intrusion without claiming more than the records establish.

Endpoint record
10:14 UTC: account render-admin created task RenderCacheRefresh on RENDER-07; change reference absent.
Network record
10:16 UTC: RENDER-07 connected to relay.training.invalid over HTTPS.
Collection limit
The task command line is available, but initial access logs expired before collection.
Threat report
An unrelated campaign previously used the same multi-tenant relay provider; no shared tenant identifier is known.

Your task

  1. Map the supported observations using two frameworks.
  2. State two claims that the available evidence cannot support.
  3. Assign one collection task and one defensive validation task.
Compare your response

ATT&CK can describe the observed scheduled-task behaviour; the Diamond Model links the workstation victim, task-related capability, and relay infrastructure. Record render-admin as the account used, without equating the account holder with the adversary.

Initial access and the operator identity remain unknown. A shared relay provider is too weak to attribute the activity or declare it part of the unrelated campaign.

Preserve the task definition and investigate account authorisation through surviving identity records. Separately, use an approved task-creation exercise to confirm that task identity, command line, and alert routing are visible. Report collection gaps alongside the findings.

Put it into practice

Use these labs alongside this module.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. Two suspicious sessions used different domains on the same shared hosting provider. A manager asks whether one adversary controlled both. Which answer is best?
2. A synthetic exercise produces endpoint events for script execution, but the analyst sees no events in the SIEM. What should a coverage review record first?
3. An analyst has a task definition and its creation time but no evidence of how access was obtained. How should a Kill Chain summary handle earlier stages?

0 of 3 answered

← Course curriculumNext module: 3.2 →

Source reading: supplied book, chapters 9. Lessons, scenarios, and questions are original CyberCorps course material.