Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Higaisa (threat actor)

Risk

High

28 techniques 2 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1059.007

JavaScript execution

T1106

Native API execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1124

System Time Discovery discovery

T1680

Local Storage Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1001.003

Protocol or Service Impersonation command and control

T1071.001

Web Protocols command and control

T1090.001

Internal Proxy command and control

T1573.001

Symmetric Cryptography command and control

›

7 Actions on Objectives

T1029

Scheduled Transfer exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1027.001

Binary Padding stealth

T1027.013

Encrypted/Encoded File stealth

T1027.015

Compression stealth

T1036.004

Masquerade Task or Service stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1220

XSL Script Processing stealth

T1564.003

Hidden Window stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

PlugX gh0st RAT

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +8 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (10)

M1013 Application Developer Guidance M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +5 more

Detection Coverage

28 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (7)

DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +2 more

Installation (6)

DET0034 Detection of Adversarial Process Discove... DET0151 Behavior-chain, platform-aware detection... DET0188 Local Storage Discovery via Drive Enumer... DET0195 Behavioral Detection of System Network C... DET0365 Detect Registry and Startup Folder Persi... +1 more

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0075 Internal Proxy Behavior via Lateral Host... DET0143 Detection Strategy for Encrypted Channel... DET0470 Detecting Protocol or Service Impersonat...

Actions on Objectives (10)

DET0087 Encrypted or Encoded File Payload Detect... DET0117 Detection of Masqueraded Tasks or Servic... DET0128 Detection Strategy for Hidden Windows DET0201 Detection Strategy for Hijack Execution... DET0205 Detect XSL Script Abuse via msxsl and wm... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Higaisa

Type: Unknown Active

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

28 technique(s) 2 tool(s)/malware

PlugX gh0st RAT

command and control

T1001.003 T1071.001 T1090.001 T1573.001

discovery

T1016 T1057 T1082 T1124 +1

execution

T1053.005 T1059.003 T1059.005 T1059.007 +3

exfiltration

T1029 T1041

Victim

70%

Targeted Sectors

government

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

PlugX gh0st RAT

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.003 T1059.005 T1059.007 T1106

Capability (Malware)

PlugX gh0st RAT

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1016 T1057 T1082 T1124 T1680

Capability (Malware)

PlugX gh0st RAT

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1001.003 T1071.001 T1090.001 T1573.001

Capability (Malware)

PlugX gh0st RAT

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1029 T1041

Capability (Malware)

PlugX gh0st RAT

Infrastructure

No infra linked