Chapter 4
Classifying Threats

At the highest level of classification, every threat is either known or unknown. Understanding this distinction drives everything from your tooling choices to your incident response posture.

Unknown threat sub-types

The four-quadrant model (Johari Window)

Threat classification maps directly to the Johari Window concept. The goal is always to move threats toward "open/known" so signatures or automation can block them.

A threat actor is any entity that wants to harm your networks or steal data. Not all threat actors are equal — they differ in skill, funding, motivation, and target selection. In cybersecurity, we distinguish black hat (unauthorized/malicious), white hat (authorized/ethical), and gray hat (semi-authorized) hackers. Below are the eight main categories you must know for the exam.

Beyond basic malware types (viruses, worms, Trojans — assumed knowledge from Security+), the CySA+ exam focuses on three higher-level categories that drive incident severity assessment.

Command & Control (C2)

APTs maintain persistence through a C2 (Command and Control) node — infrastructure that allows the attacker to direct, distribute, and control malware across a botnet of compromised machines. Once established, the bot master can issue commands to all bots simultaneously (e.g., launch a DDoS, pivot laterally, exfiltrate data).

C2 channels use evasion techniques to resist detection and blocking:

Persistence is the ability of a threat actor to maintain covert access to a target host or network. Studies show APTs remain undetected for an average of six to nine months, giving them ample time to exfiltrate data or conduct further operations.

As attackers move away from static malware toward sophisticated behavioral techniques, analysts must correlate multiple indicators rather than rely on a single signature. Threat research provides the foundation for both detection and threat hunting.

1 — Reputational threat research

Uses reputation data — blacklists of known-bad sources: malware signatures, IP ranges, DNS domains. Tools like Cisco Talos Intelligence assign each source a granular reputation score (good / neutral / poor). Reputation data anchors the known-threat layer of your research.

2 — Indicators of Compromise (IOC)

An IOC is a residual sign that an asset or network has been successfully attacked, or is actively being attacked. Individual IOCs are weak signals; correlated patterns of IOCs are strong evidence.

3 — Behavioral threat research & TTPs

Correlating IOCs into recognizable attack patterns produces TTPs — Tactics, Techniques, and Procedures. TTPs describe how an adversary operates based on historical attack data, enabling analysts to anticipate the next move and attribute activity to a specific threat actor.

Three frameworks provide structured ways to model adversary behavior. They can be used individually or combined for maximum analytical depth.

5.1 — Lockheed Martin Cyber Kill Chain

A seven-step linear model (Hutchins, Cloppert & Amin, Lockheed Martin) describing an attack from initial reconnaissance through final objectives. Each step is an opportunity to detect, deny, disrupt, degrade, deceive, or destroy an attacker's capability (the "Six Ds").

5.2 — MITRE ATT&CK Framework

A knowledge base maintained by MITRE Corporation at attack.mitre.org (free and open source). Unlike the linear kill chain, ATT&CK uses a matrix model where each column is a tactic and each cell is a specific technique. It is much more granular and better suited to post-exploitation analysis. An additional pre-ATT&CK matrix covers the reconnaissance and weaponization phases not represented in the main matrix.

The ATT&CK Navigator tool lets analysts overlay a specific APT group's known TTPs onto the matrix, making it easy to compare observed activity against documented adversary behavior and identify defensive gaps.

5.3 — Diamond Model of Intrusion Analysis

Every intrusion event has four core features that are always related to each other: Adversary, Capability, Infrastructure, and Victim. The Diamond Model is especially useful for attribution and for understanding how one element of an incident points toward others.

In practice, evidence about one corner of the diamond quickly points toward the others. For example: identifying malware (Capability) may contain a hardcoded C2 domain (Infrastructure); resolving that domain reveals IP ownership (Adversary attribution); checking firewall logs confirms which systems called home (Victim scope).

Threat intelligence is only valuable if it can be shared quickly and consumed automatically. Four standardized formats and platforms make this possible.

STIX v2 JSON format — what it looks like

On the exam, if you see JSON like the following, think STIX version 2. STIX v1 used XML — v2 uses JSON. The exam only tests v2.

{
  "type": "indicator",
  "id": "indicator--26ffb872-1dd9-4b3a-b65f-72e3f8a",
  "created": "2024-03-15T08:00:00.000Z",
  "modified": "2024-03-15T08:00:00.000Z",
  "name": "Malicious IP indicator",
  "pattern": "[ipv4-addr:value = '198.51.100.42']",
  "valid_from": "2024-03-15T08:00:00.000Z",
  "labels": ["malicious-activity"]
}