Interview question
You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.
The canonical Diamond Model question. Interviewers are listening for a structured pivot sequence and for restraint about what infrastructure overlap actually proves.
What a strong answer covers
- Frames the work as pivoting across the Diamond Model vertices: infrastructure, capability, victim, adversary.
- Infrastructure to capability: which samples beacon to this address, do they share configuration or a builder.
- Infrastructure to infrastructure: passive DNS for historical resolutions, certificate transparency, TLS or service fingerprints, hosting and registrar patterns.
- Infrastructure to victim: who else in our telemetry or in public reporting contacted it, and does a sector or geography pattern emerge.
- Only after clustering does adversary attribution become a tentative question, and it stays hedged.
- Explicitly filters shared hosting, CDNs, compromised third-party servers and commodity VPS ranges before treating co-residency as a link.
- Raises collection operational security — passive sources first, no active interaction from attributable infrastructure.
- Checks internal scope first: who else in our environment talked to this address, and over what period.
- Records provenance for each pivot so the reasoning is reconstructable later.
Expert answer
I would treat the IP as one vertex of a diamond and work outward, and the first move is actually internal rather than external.
Internally: who else in our estate contacted that address, over what period, and what did those hosts have in common? That scopes the incident and often changes its priority immediately. I would also check what the beacon looked like — interval, jitter, URI patterns — because that characterises the channel even before I know the family.
Externally, and passively. Passive DNS for what names resolved to that address and when, which gives me a candidate domain set with time bounds. Certificate transparency for certificates issued to those names or presented on that host, which sometimes reveals naming conventions and additional hostnames before they are used. Scan data for what services were listening, with banners and any C2 framework fingerprint.
Infrastructure to capability: which samples in public repositories beacon to this address or these domains? If I get samples, do they share a configuration format, a builder artefact, or code overlap? That is a more durable link than the infrastructure itself.
Infrastructure to victim: does public reporting associate this infrastructure with victims, and is there a sector or geography pattern that includes us?
Adversary comes last and stays tentative. If tradecraft and capability cluster consistently, I would track it under our own designation and note any overlap with publicly reported groups as an observation with the specific evidence and a confidence level — not as an identification.
Two constraints throughout. First, I filter hard before treating co-residency as a link: shared hosting, CDN ranges, bulletproof providers and compromised legitimate servers produce overlaps between completely unrelated actors, so "these domains resolved to the same IP" is weak on its own. Second, operational security — I stay on passive sources. Resolving the domain, fetching a payload or connecting to the host from our corporate range tells the adversary we found them and attributes us. If I need to go active, that is a decision to take deliberately and from infrastructure that is not attributable to us.
I would record the provenance of every hop, because in three months someone will ask why I believed two things were related.
Mistakes that cost candidates points
- Jumping straight to an actor name from infrastructure overlap.
- Treating shared hosting co-residency as evidence of a link.
- Forgetting to scope internally before pivoting externally.
- Proposing active interaction — resolving, scanning or fetching — from attributable infrastructure.
- Listing tools without describing what each pivot would establish.
- No mention of provenance or of how confident each link is.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.
- What is F3EAD, and why do some CTI teams prefer it to the traditional intelligence cycle?
- What is the difference between saying something is "likely" and saying you have "high confidence" in an assessment? Can you have high confidence in an unlikely outcome?