During a phishing incident, a SOC analyst has a malware sample, an attacker C2 server, an attributed threat-actor persona, and an infected workstation. Using the Diamond Model, which mapping is correct?

The Diamond Model separates an event into adversary, capability, infrastructure, and victim so analysts can reason about relationships instead of naming a single tool. A malware sample is a capability because it is the technique or tool used to affect the target. A command-and-control server is infrastructure because it is the location, service, or resource used by the adversary to communicate or operate. An attributed threat-actor persona, such as the operator alias behind the phishing campaign, is the adversary vertex, while the infected workstation is the victim because it is the asset being affected. Note that a compromised employee account would not be the adversary: it is a victim asset, or infrastructure the adversary borrows. A mapping that calls malware infrastructure confuses the tool with the location; C2 is not the method but the channel. A mapping that calls the persona victim mistakes the actor for the target. A mapping that calls the workstation capability reverses roles because the workstation is being acted upon, not the instrument of attack. Exam caveat: Diamond Model questions often hinge on whether an artifact is the actor, the method, the location, or the target. Operational check: For each artifact, ask who or what is acting, what is being used, where communication occurs, and what is harmed, then place it on the diamond.