Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Contagious Interview (threat actor)

Risk

High

54 techniques 4 tools/malware 0 vulnerabilities 0 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

T1593

Search Open Websites/Domains reconnaissance

T1593.001

Social Media reconnaissance

T1593.003

Code Repositories reconnaissance

T1681

Search Threat Vendor Data reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.006

Web Services resource development

T1585

Establish Accounts resource development

T1585.001

Social Media Accounts resource development

T1585.002

Email Accounts resource development

T1587

Develop Capabilities resource development

T1587.001

Malware resource development

T1588.002

Tool resource development

T1588.007

Artificial Intelligence resource development

T1608.001

Upload Malware resource development

T1683.001

Written Content resource development

T1683.002

Audio-Visual Content resource development

›

3 Delivery

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

T1059.005

Visual Basic execution

T1059.006

Python execution

T1059.007

JavaScript execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1204.004

Malicious Copy and Paste execution

T1204.005

Malicious Library execution

T1546.004

Unix Shell Configuration Modification privilege escalation

›

5 Installation

T1555.001

Keychain credential access

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1543.001

Launch Agent persistence

T1547.001

Registry Run Keys / Startup Folder persistence

T1547.013

XDG Autostart Entries persistence

›

6 Command & Control

T1071.003

Mail Protocols command and control

T1090

Proxy command and control

T1219.002

Remote Desktop Software command and control

T1571

Non-Standard Port command and control

T1573.001

Symmetric Cryptography command and control

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1567.002

Exfiltration to Cloud Storage exfiltration

T1657

Financial Theft impact

T1027.010

Command Obfuscation stealth

T1027.013

Encrypted/Encoded File stealth

T1036

Masquerading stealth

T1070.004

File Deletion stealth

T1480

Execution Guardrails stealth

T1497

Virtualization/Sandbox Evasion stealth

T1684.001

Impersonation stealth

Stage risk: Critical High Medium None

Tools & Malware (4)

BeaverTail HexEval Loader InvisibleFerret XORIndex Loader

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1013 Application Developer Guidance M1047 Audit M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (5)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1049 Antivirus/Antimalware

Exploitation (10)

M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more

Installation (4)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1027 Password Policies M1033 Limit Software Installation

Command & Control (6)

M1020 SSL/TLS Inspection M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1038 Execution Prevention +1 more

Actions on Objectives (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Detection Coverage

54 strategies

7/7 stages covered

Reconnaissance (5)

DET0805 Detection of Code Repositories DET0812 Detection of Social Media DET0841 Detection of Gather Victim Identity Info... DET0856 Detection of Search Open Websites/Domain... DET0866 Detection of Search Threat Vendor Data

Weaponization (14)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0842 Detection of Artificial Intelligence DET0851 Detection of Social Media Accounts +9 more

Delivery (1)

DET0115 Detection Strategy for Spearphishing via...

Exploitation (10)

DET0020 Detect Shell Configuration Modification... DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... +5 more

Installation (6)

DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc... DET0390 Linux Detection Strategy for T1547.013 -... DET0396 Detect Access to macOS Keychain for Cred... DET0434 Detection of Launch Agent Creation or Mo... +1 more

Command & Control (5)

DET0135 Detection of Mail Protocol-Based C2 Acti... DET0143 Detection Strategy for Encrypted Channel... DET0227 Detection Strategy for Non-Standard Port... DET0259 Remote Desktop Software Execution and Be... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (13)

DET0046 Detection Strategy for T1497 Virtualizat... DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0149 Detection of Exfiltration Over Unencrypt... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Contagious Interview

Type: Unknown Active

DeceptiveDevelopment Gwisin Gang Tenacious Pungsan DEV#POPPER PurpleBravo +8 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

54 technique(s) 4 tool(s)/malware

BeaverTail HexEval Loader InvisibleFerret XORIndex Loader

command and control

T1071.003 T1090 T1219.002 T1571 +1

credential access

T1555.001

defense impairment

T1685

discovery

T1082 T1083

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1593 T1593.001 T1593.003 T1681

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.003 T1583.006 T1585

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1566.003

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003 T1059.004 T1059.005 T1059.006 T1059.007

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1555.001 T1082 T1083 T1543.001 T1547.001

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1071.003 T1090 T1219.002 T1571 T1573.001

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1041 T1048.003 T1567 T1567.002 T1657

Capability (Malware)

BeaverTail HexEval Loader InvisibleFerret

Infrastructure

No infra linked