---
title: "Research · 5 Threat Intelligence & Adversary Modeling · VORNAC"
description: "Diamond model, kill chains, attribution, and threat modeling. 5 curated notes across featured, reference, and background tiers."
url: https://www.vornac.com/en/research/threat-intelligence
lang: en
published: 2026-06-02
updated: 2026-06-02
alternate_de: https://www.vornac.com/research/threat-intelligence
---

[Research Index](https://www.vornac.com/en/research) / 5 · Threat Intelligence & Adversary Modeling

VORNAC RESEARCH

5

# Threat Intelligence & Adversary Modeling.

Diamond model, kill chains, attribution, and threat modeling.

5

Notes in this domain

1

Featured

0

Reference

4

Background

Featured

Featured

2 phases

### [OSINT — Recon Mindmap](https://www.vornac.com/en/research/threat-intelligence/osint-mindmap)

Open-source intelligence routes by entity type: people, organizations, infrastructure, code, leaks. The recon companion to engagement scoping.

Recon OSINT

Background

-   [Threat Modeling — Canonical Reference](https://www.vornac.com/en/research/threat-intelligence/threat-modeling-canon)

    STRIDE, LINDDUN, attack-tree, and the Diamond model as a structured note-taking template — paired with the preventive and responsive control maps over the attack lifecycle.

    Recon · Known CVEs

-   [APT Operations — Reference](https://www.vornac.com/en/research/threat-intelligence/apt-operations)

    How sustained adversaries operate end-to-end: initial-access patterns, tooling and TTP overlap, Windows persistence ranking, and the discovery/impact assessment workflow.

    —

-   [Red Team Planning & Intel Analysis](https://www.vornac.com/en/research/threat-intelligence/red-team-planning)

    Adversary-simulation planning tree (objective, profile, infrastructure, evasion, deconfliction) and the source-rating discipline that keeps a threat-intel report honest about confidence.

    —

-   [Email & Fraud — Investigation Reference](https://www.vornac.com/en/research/threat-intelligence/email-and-fraud-forensics)

    Triage workflow for a suspicious email (header reasoning, detonation, URL pivot) and the investigative routes for transaction fraud across account, device, and payment dimensions.

    Recon

[Previous domain 4 · Operational Technology & Embedded](https://www.vornac.com/en/research/ot-embedded) [All eight domains](https://www.vornac.com/en/research) [Next domain 6 · Reverse Engineering, Binary & Malware](https://www.vornac.com/en/research/reverse-malware)

From reference to evidence

## Validate these gaps in your own environment.