5.2Digital forensics and attack attribution

After an incident, clarifying "who, how, and how far" is the work of digital forensics and attack attribution. Here we learn three viewpoints—the Cyber Kill Chain (an attack as stages), MITRE ATT&CK (a catalog of techniques), and the Diamond Model (an event drawn as four elements)—plus TTP (an attacker's methods), artifacts as evidence sources, and the evidence preservation and chain of custody that protect authenticity so evidence holds up even in court. In CCST the aim is not deep analysis but being able to identify "what each framework is meant to organize."

5.2.1Three frameworks for organizing an attack, and TTP

• The Cyber Kill Chain (Lockheed Martin) captures an attack as time-ordered stages in a seven-stage model: reconnaissance -> weaponization -> delivery -> exploitation -> installation -> command and control (C2) -> actions on objectives. It gives a common language for "which stage the attack is at now" and the idea of breaking the chain early.
• MITRE ATT&CK is a knowledge base that catalogs attacker methods (tactics and techniques) actually observed into a matrix. Whereas the Kill Chain is a "time-ordered flow," ATT&CK is a dictionary of concrete methods used in each phase, used to match "which technique this trace corresponds to."
• The Diamond Model organizes a single intrusion event into four vertices—Adversary, Capability, Infrastructure, and Victim. TTP is the umbrella term for an attacker's Tactics, Techniques, and Procedures—the "signature of their methods" that gives clues for attribution (whose work it is).

5.2.2Evidence sources (artifacts) and handling evidence

• An artifact is a trace that serves as an evidence source for investigation: logs, memory dumps, disk images, the registry, executables, traffic captures, and more. Forensics collects these to reconstruct "what happened." At the introductory level it is enough to identify where evidence is left.
• Evidence preservation means acquiring and storing evidence while keeping its original state so it is not altered or destroyed. The basics: do not touch the original directly, take a copy (image), and guarantee sameness with a hash value. Order matters too—there is a principle of securing the most volatile items (like memory) first.
• Chain of custody is a chain of management that records without gaps "who handled the evidence, when, where, and how." If it breaks, you cannot prove the evidence was not swapped along the way, and its legal admissibility can be lost. This is where procedural rigor, more than technology, is tested.

Suppose you are handed the initial investigation of an intrusion. A possibly infected host sits in front of you and you must judge "what to do first." Rebooting the host in a panic, or opening the suspected file directly to check its contents, are mistakes beginners often make—because a reboot erases the artifacts in memory (running processes, network connections), and touching the original directly changes the state of the evidence. The correct entry is evidence preservation: avoid touching the original as much as possible, take a copy (image) of the disk, record sameness with a hash value, and secure the most volatile items like memory first. And from the very start you run a chain of custody, recording one by one who handled which evidence, when, and how. Neglect this, and when later asked "was that evidence tampered with along the way?" you cannot rebut it, and hard-won evidence becomes unusable. Once evidence is gathered, next comes organization and attribution. To see, in time order, "how far the attack progressed from reconnaissance to C2 to actions on objectives," the Cyber Kill Chain helps; to match "which method (technique) each observed trace corresponds to," MITRE ATT&CK helps. Surveying the event by the four elements "Adversary, Capability, Infrastructure, Victim" is the Diamond Model, and if these TTP (signatures of method) match past attacks, they give clues for attribution. The lesson is a sense of order: in forensics, before "analysis technique" comes "procedure that does not break the evidence," and the frameworks are tools for organizing and attributing the evidence you collected.

5.2.3Section summary

• The Cyber Kill Chain is seven time-ordered stages; MITRE ATT&CK is a dictionary of methods; the Diamond Model is the four elements Adversary/Capability/Infrastructure/Victim; TTP gives clues for attribution
• Artifacts (logs, memory, disk, etc.) are evidence sources; do evidence preservation with a copy and hash without breaking the original
• The chain of custody records evidence handling without gaps to protect admissibility—a procedure demanding rigor over technology