The Diamond Model of Intrusion Analysis in AWS
Explore the Diamond Model of Intrusion Analysis and how it can be applied to AWS security. Learn how Adversary, Capability, Infrastructure, and Victim connect to help security teams understand attacks and investigate threats. See how AWS services such as Amazon GuardDuty, AWS CloudTrail, Amazon Detective, IAM, Amazon Macie, and AWS Security Hub provide valuable visibility for detecting suspicious activity, analyzing incidents, and strengthening cloud security.
The Diamond Model of Intrusion Analysis in AWS
In cybersecurity, detecting an attack is only the beginning. Security teams also need to understand who is attacking, what they are targeting, what infrastructure they are using, and what capabilities they have.
One useful framework for doing this is the Diamond Model of Intrusion Analysis.
The Diamond Model represents an intrusion event using four core elements:
💎 Adversary
💎 Capability
💎 Infrastructure
💎 Victim
💎 Capability
💎 Infrastructure
💎 Victim
When combined with AWS security services, this model can help security teams organize threat intelligence, investigate suspicious activity, and understand how an attacker operates within a cloud environment.
💎 1. Adversary
The Adversary represents the threat actor behind an attack.
An adversary could be:
- Cybercriminal groups
- Nation-state actors
- Insider threats
- Hacktivists
- Initial access brokers
- Ransomware groups
AWS Example
Suppose an attacker obtains compromised AWS credentials and attempts to access resources in an AWS account.
AWS services that can help identify adversary activity include:
AWS CloudTrail – Records API activity such as
ConsoleLogin, RunInstances, CreateUser, and AttachRolePolicy.Amazon GuardDuty – Detects suspicious behavior and potential threats involving AWS accounts, workloads, and data.
IAM – Helps identify which identities and roles are involved in suspicious activity.
The goal is not simply to ask:
"What happened?"
Instead, security analysts can ask:
"Which threat actor or identity could be responsible?"
💎 2. Capability
Capability represents the tools, techniques, malware, exploits, or knowledge that an adversary uses to conduct an attack.
Examples include:
- Credential theft
- Phishing
- Malware
- Vulnerability exploitation
- Privilege escalation
- Brute-force attacks
- Data exfiltration
- Command and control
AWS Example
An attacker compromises an IAM credential and uses it to perform unauthorized API calls.
For example:
1
2
3
4
5
6
7
8
9
Compromised Credential
↓
AWS API Access
↓
Privilege Escalation
↓
Resource Discovery
↓
Data Access
AWS security services can provide visibility into these activities.
CloudTrail can record API calls.
GuardDuty can detect suspicious behavior.
IAM Access Analyzer can help identify unintended access.
AWS Security Hub can centralize security findings from multiple AWS security services.
The capability component helps analysts understand how the attacker was able to perform the attack.
💎 3. Infrastructure
Infrastructure represents the resources and systems that an adversary uses to conduct or support an attack.
This could include:
- IP addresses
- Domains
- Command-and-control servers
- Compromised systems
- Malware hosting infrastructure
- Cloud resources
- Botnets
AWS Example
Imagine an EC2 instance inside an AWS environment begins communicating with a suspicious external IP address.
A security investigation could look like:
1
2
3
4
5
6
7
EC2 Instance
↓
Suspicious IP Address
↓
Command & Control Server
↓
Possible Malware Activity
AWS services that can help investigate this include:
Amazon GuardDuty – Can identify suspicious network and account activity.
VPC Flow Logs – Provide information about network traffic flows.
CloudTrail – Helps determine what AWS API actions were performed.
Amazon Detective – Helps security teams investigate relationships between resources, users, IP addresses, and activities.
Infrastructure is important because attackers often reuse infrastructure across multiple attacks.
💎 4. Victim
The Victim represents the target of the attack.
In AWS, the victim could be:
- An IAM user
- An IAM role
- An EC2 instance
- An S3 bucket
- A database
- An application
- An entire AWS account
- Sensitive business data
AWS Example
An attacker discovers an improperly secured S3 bucket containing sensitive information.
The attack might look like:
1
2
3
4
5
6
7
8
9
10
11
Adversary
↓
Uses stolen credentials
↓
Accesses AWS
↓
Discovers S3 bucket
↓
Accesses sensitive data
↓
Exfiltrates information
AWS security controls such as Amazon Macie can help discover and protect sensitive data stored in Amazon S3.
IAM policies and S3 bucket policies can also be used to enforce least-privilege access.
🔗 Connecting the Four Elements
The real power of the Diamond Model comes from connecting the four elements together.
Consider this example:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
ADVERTSARY
Threat Actor
◆
/ \
/ \
/ \
/ \
CAPABILITY ─── INFRASTRUCTURE
Stolen IAM Malicious IP
Credentials C2 Server
\ /
\ /
\ /
\ /
\ /
\/
VICTIM
AWS Account
Instead of investigating individual alerts separately, analysts can connect them into a larger story.
For example:
Adversary: Threat actor
Capability: Stolen IAM credentials
Infrastructure: Suspicious IP address
Victim: AWS account containing sensitive resources
This creates a much clearer picture of the intrusion.
🛡️ Mapping the Diamond Model to AWS Security Services
| Diamond Model | AWS Security Services |
|---|---|
| Adversary | CloudTrail, GuardDuty, Detective |
| Capability | GuardDuty, CloudTrail, Security Hub |
| Infrastructure | GuardDuty, VPC Flow Logs, Detective |
| Victim | IAM, S3, EC2, Macie, Security Hub |
These services do not replace the Diamond Model. Instead, they provide the telemetry and security findings that analysts can use with the model.
🔍 Example: Investigating a Suspicious AWS Login
Imagine an organization receives a GuardDuty finding involving suspicious account activity.
An analyst could use the Diamond Model to structure the investigation.
1. Identify the Victim
Which AWS account, resource, or identity was targeted?
1
Victim → AWS IAM User
2. Identify the Capability
How did the attacker gain access?
1
Capability → Compromised Credentials
3. Identify the Infrastructure
Where did the activity originate?
1
Infrastructure → Suspicious IP Address
4. Identify the Adversary
Can the activity be connected to a known threat actor or campaign?
1
Adversary → Potential Threat Group
The analyst can then use CloudTrail, GuardDuty, Detective, and other telemetry to validate these relationships.
🚨 Why the Diamond Model Is Useful in AWS
Cloud environments can generate enormous amounts of security data.
Without a structured approach, analysts may focus only on individual alerts.
The Diamond Model encourages analysts to ask:
Who is attacking?
What capabilities are they using?
What infrastructure are they using?
Who or what is being targeted?
This helps transform individual security events into a threat narrative.
🔐 From Detection to Threat Intelligence
The Diamond Model can also support threat intelligence.
For example, an analyst might discover:
1
2
3
4
5
6
7
8
9
10
11
Adversary
↓
Uses credential theft
↓
Uses malicious infrastructure
↓
Targets AWS IAM identities
↓
Attempts privilege escalation
↓
Accesses sensitive S3 data
This information can then be used to improve security controls.
Possible defensive actions include:
- Enforcing least privilege with IAM
- Enabling MFA
- Monitoring CloudTrail activity
- Investigating GuardDuty findings
- Protecting sensitive S3 data with Macie
- Monitoring network activity
- Centralizing findings with Security Hub
- Investigating incidents with Amazon Detective
🎯 Final Thoughts
The Diamond Model of Intrusion Analysis provides a simple but powerful way to understand cyber attacks.
By connecting:
Adversary + Capability + Infrastructure + Victim
security teams can move beyond simply responding to alerts and start understanding the relationships behind an attack.
In AWS environments, services such as Amazon GuardDuty, AWS CloudTrail, Amazon Detective, IAM, Amazon Macie, VPC Flow Logs, and AWS Security Hub can provide valuable evidence for building those relationships.
The key idea is simple:
Don't just investigate the alert. Investigate the relationships behind the attack.
That mindset can help AWS security teams detect threats faster, investigate incidents more effectively, and build stronger defenses.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article