Lab 02 — Kill-Chain Campaign Reconstructor + Diamond-Model Pivot

Lenses: Cyber Kill Chain + MITRE ATT&CK (the chain) and the Diamond Model (the pivot). WARMUP: Chapters 2, 4, 7, 8. Engagement tie-in: the purple-team replay of Operation Cedar Lattice — after the FIN-LATTICE emulation runs, the SOC's scattered alerts are reconstructed into one campaign narrative, and the analyst pivots on shared C2 to find the events they missed.

The problem

An intrusion never arrives as a tidy timeline. It arrives as scattered, out-of-order events — an alert from the mail gateway, a Sysmon process-create three hours later, a proxy log entry from before either. The analyst's first job is to turn that pile into a campaign: order it along the attacker lifecycle, report how far the adversary got, and find the earliest, cheapest place to break the chain ("defend left" — the lower the tactic, the more downstream damage a control there prevents).

But ordering is only the kill-chain view ("how far along?"). The second analytic move is the Diamond Model view ("what else is connected?"): two events that used the same C2 infrastructure or the same capability (loader/malware) are likely the same campaign — even when you cannot yet name the adversary. That pivot is how a threat-intel analyst expands from one indicator to the rest of the intrusion and toward attribution.

This lab does both: reconstruct + break-point on one axis, Diamond pivot on the other.

What you build (lab.py)

  • classify(technique_id) — {technique, name, tactic, order, break_control} (unknown ids sort last).
  • reconstruct(events) — order events by (tactic order, timestamp, event_id), preserving the Diamond meta-features.
  • tactics_reached(events) / furthest_tactic(events) — "how far along is this intrusion?" (furthest_tactic ignores unplaceable/unknown techniques — you cannot claim a stage you cannot map).
  • earliest_break(events) — the lowest-order placeable event and the control that breaks the chain there.
  • pivot(events, on='infrastructure'|'capability') — the Diamond pivot: clusters of events sharing a non-None value of that meta-feature, linked transitively, returned as sorted id-tuples (singletons dropped — a lone event has nothing to pivot to).

ATT&CK / framework mapping

Events map to the same representative ATT&CK technique slice as Lab 01, sequenced by Enterprise tactic order (the kill chain). The infrastructure and capability fields are the Diamond Model meta-features (the lower vertices: infrastructure and capability); pivot is the shared-meta-feature correlation that the WARMUP's Diamond chapter describes.

Attack cases the tests cover

  • A FIN-LATTICE ransomware intrusion observed out of order is reconstructed into lifecycle order (phish → execution → lateral movement → C2 → impact), with the Diamond features preserved.
  • furthest_tactic reports the deepest placeable stage; earliest_break returns the lowest-order tactic (preferring reconnaissance when present) with its control.
  • pivot(on='infrastructure') links the two events sharing a C2 IP; pivot(on='capability') links the two sharing a loader; pivoting is transitive; None values and singletons are ignored; an unsupported feature raises ValueError.
  • Unknown-only input is unplaceable (no furthest tactic, no break point); empty input is handled; reconstruction and pivot are deterministic.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q   # reference passes (16 tests)
pytest -q                        # your implementation after the TODOs

Hardening / detection (the break-the-chain pairing)

earliest_break is the detection pairing: for the cheapest stage in the chain it names the control that would have stopped the campaign before it deepened. The reconstruction also makes the detection-gap narrative explicit — every tactic the chain reached that the SOC did not alert on is a gap the purple-team replay (HITCHHIKERS-GUIDE.md) turns into a durable detection. The Diamond pivot is itself a defensive tool: once you have one C2 indicator, pivoting finds every other event that touched it, so you can scope and contain the whole intrusion, not just the alert you saw.

Extensions (your own isolated range)

  • Add the victim and adversary vertices and infer attribution-by-association across a pivoted cluster (flag conflicting adversaries — pivoting can mislead).
  • Score dwell time (first-to-last event) and flag the longest undetected gap between stages.
  • Emit an ATT&CK Navigator layer of the reconstructed campaign.
  • Weight infrastructure indicators by Pyramid of Pain level — pivoting on a TTP is far more durable than pivoting on an IP the actor rotates daily.
  • Load the real ATT&CK STIX bundle for full technique → tactic coverage and sub-techniques.

Interview / resume

"Built a campaign reconstructor that orders scattered security events along the ATT&CK lifecycle, reports how far an intrusion progressed and the earliest break point with its control ('defend left'), and a Diamond-Model pivot that links events sharing infrastructure or capability into one campaign — the analytic move behind threat correlation and scoping."

Limitations: a representative technique slice, not the full ATT&CK matrix; single tactic per technique; lifecycle order approximated by Enterprise tactic order; pivoting uses exact-match meta-features (no fuzzy/derived indicators); reasons over synthetic event metadata only — no payloads, no live targets, no weaponization.