Attack Framework Selector

About this interactive

This module covers four ways to make sense of attacks. Each card is a job a security team needs done, from tracing an intrusion to planning defenses or looking up a group. Sort it into the model or knowledge base built for that job.

What you'll learn

Choose the attack methodology model or resource that fits a security task: MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model of Intrusion Analysis or CAPEC
Distinguish the kill chain's streamlined flow, ATT&CK's knowledge base of tactics, techniques and groups, the Diamond Model's event analysis and CAPEC's catalog of attack patterns

Aligned to

CompTIA CySA+

3.1 Explain concepts related to attack methodology frameworks.

1.4 Compare and contrast threat-intelligence and threat-hunting concepts.

Key terms

MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Cyber Kill Chain: The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.
Diamond Model of Intrusion Analysis: A framework used by cybersecurity professionals to analyze intrusions by examining the relationships between an adversary, their capabilities, infrastructure, and the victim.
Common Attack Pattern Enumeration and Classification: CAPEC is a MITRE-maintained knowledge base that catalogs common cyber attack patterns with detailed descriptions of how adversaries exploit weaknesses, used to inform threat modeling and defensive security controls.
Attack Pattern: A recurring method or sequence of steps used by an adversary to compromise systems, which can be used to identify and attribute threat actors.
Adversary Group: A tracked threat actor collective, such as a nation-state or criminal organization, whose known tactics, techniques, and procedures are documented in the MITRE ATT&CK framework.
Attribution: The process of identifying the individual, group, or nation-state responsible for a cyberattack or malicious activity.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →