Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Sunglow Blizzard (threat actor)

Risk

High

16 techniques 40 tools/malware 0 vulnerabilities 1 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

No data

›

5 Installation

T1040

Network Sniffing credential access

T1555

Credentials from Password Stores credential access

T1557

Adversary-in-the-Middle credential access

T1046

Network Service Discovery discovery

T1087

Account Discovery discovery

T1133

External Remote Services persistence

›

6 Command & Control

T1005

Data from Local System collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1090

Proxy command and control

T1021

Remote Services lateral movement

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1078

Valid Accounts stealth

T1564

Hide Artifacts stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla BLINDINGCAN BRAIN BlackEnergy CaddyWiper Chollima Cobalt Dark Emissary Ghost RAT GhostEmperor Global Hades Hafnium Imperial Kitten Indrik Spider Jackal Labyrinth Labyrinth Chollima Lynx Malware Mango Maze Mirage Mythic OlympicDestroyer Phoenix Pink Royal Snake Sofacy Solar Thallium Tsunami Unknown Velvet Chollima Void WAVESHAPER Wicked crimson

Indicators of Compromise (1)

Filename

MicrosoftMapping.json

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (14)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +9 more

Command & Control (13)

M1018 User Account Management M1020 SSL/TLS Inspection M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +8 more

Actions on Objectives (13)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +8 more

Detection Coverage

16 strategies

4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (6)

DET0296 Detect Adversary-in-the-Middle via Netwo... DET0314 Detection Strategy for Network Sniffing... DET0354 Behavior-chain detection for T1133 Exter... DET0376 Behavioral Detection Strategy for Networ... DET0430 Detect Credentials Access from Password... +1 more

Command & Control (6)

DET0027 Detection of Web Protocol-Based C2 Over... DET0269 Behavioral Detection Strategy for Remote... DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... DET0444 Detection of Command and Control Over Ap... +1 more

Actions on Objectives (3)

DET0348 Detection Strategy for Exfiltration Over... DET0502 Detection Strategy for Hidden Artifacts... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

60%

Sunglow Blizzard

Type: Unknown Active

DEV-0665 APT28 Pawn Storm Fancy Bear the Newscaster Team +5 more

Infrastructure 0 IOC(s)

50%

No infrastructure indicators linked.

Artifacts (1)

MicrosoftMapping.json

Capability

50%

16 technique(s) 40 tool(s)/malware

Agent Tesla BLINDINGCAN BRAIN BlackEnergy CaddyWiper Chollima Cobalt Dark +32

collection

T1005

command and control

T1071 T1071.001 T1090

credential access

T1040 T1555 T1557

discovery

T1046 T1087

Victim

70%

Targeted Sectors

critical-infrastructure non-profit energy financial-services telecommunications manufacturing government think-tank media utilities entertainment

Targeted Countries

IL RU US CN KP IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Agent Tesla BLINDINGCAN BRAIN

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1040 T1555 T1557 T1046 T1087

Capability (Malware)

Agent Tesla BLINDINGCAN BRAIN

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1005 T1071 T1071.001 T1090 T1021

Capability (Malware)

Agent Tesla BLINDINGCAN BRAIN

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Agent Tesla BLINDINGCAN BRAIN

Infrastructure

No infra linked