Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Operation Emmental (threat actor)

Risk

Critical

40 techniques 40 tools/malware 18 vulnerabilities 37 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1106

Native API execution

T1129

Shared Modules execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

T1559.001

Component Object Model execution

T1569.002

Service Execution execution

T1546.010

AppInit DLLs privilege escalation

T1546.011

Application Shimming privilege escalation

T1546.012

Image File Execution Options Injection privilege escalation

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2013-3893

CVE CVE-2014-0322

CVE CVE-2014-1776

CVE CVE-2014-4114

CVE CVE-2015-2545

CVE CVE-2015-5119

CVE CVE-2015-5122

CVE CVE-2017-11882

CVE CVE-2017-8759

CVE CVE-2018-0798

CVE CVE-2018-8174

CVE CVE-2019-13720

CVE CVE-2019-2215

CVE CVE-2021-28310

CVE CVE-2021-35211

CVE CVE-2023-38831

CVE CVE-2024-21412

CVE CVE-2104-4114

›

5 Installation

T1555

Credentials from Password Stores credential access

T1614.001

System Language Discovery discovery

T1037.001

Logon Script (Windows) persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

T1547.004

Winlogon Helper DLL persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1484.002

Trust Modification defense impairment

T1553

Subvert Trust Controls defense impairment

T1553.001

Gatekeeper Bypass defense impairment

T1553.002

Code Signing defense impairment

T1553.003

SIP and Trust Provider Hijacking defense impairment

T1553.004

Install Root Certificate defense impairment

T1553.005

Mark-of-the-Web Bypass defense impairment

T1553.006

Code Signing Policy Modification defense impairment

T1055

Process Injection stealth

T1055.001

Dynamic-link Library Injection stealth

T1055.002

Portable Executable Injection stealth

T1055.003

Thread Execution Hijacking stealth

T1055.004

Asynchronous Procedure Call stealth

T1134

Access Token Manipulation stealth

T1497.001

System Checks stealth

T1497.002

User Activity Based Checks stealth

T1497.003

Time Based Checks stealth

T1622

Debugger Evasion stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

Aurora Backdoors BlackEnergy Carbanak Cobalt Confucius Conti Dark GitHub Global Kimsuky Leverage Malware Malwarebytes MiniDuke MuddyWater Naikon OceanLotus OilRig Patchwork PlugX Poison Ivy PowerShell Regin Retefe RomCom Rundll32 Sednit SentinelOne ShadowSyndicate SideWinder Sofacy Trojan Turla Unknown Void Winnti Zebrocy Zscaler phishing

Indicators of Compromise (37)

Domain

SEKOIA.IO malware.lu webhook.site README.md 2017.md

Filename

sdbinst.exe CMSTP.exe user32.dll Winlogon.exe ntsd.exe notepad.exe u202Excod.scr rcs.docx +19 more

MD5 Hash

39FD35399AB864BC0AFDFB95AF5A8ED9 DA46A41CDA2C98199BD4D267800BB3CA C81E1DC85D380045A89647FDFE8633B4 BCF1F85ABC3CA16C2505334AEA591652 BFE4755B05DEBF1B098F22ADF5CFA84D

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (17)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +12 more

Installation (10)

M1018 User Account Management M1024 Restrict Registry Permissions M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +5 more

Actions on Objectives (10)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1028 Operating System Configuration +5 more

Detection Coverage

40 strategies

3/7 stages covered

Exploitation (16)

DET0017 Detection Strategy for Application Shimm... DET0018 Behavior-chain, platform-aware detection... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... +11 more

Installation (6)

DET0072 Detect Logon Script Modifications and Ex... DET0365 Detect Registry and Startup Folder Persi... DET0404 Detect Winlogon Helper DLL Abuse via Reg... DET0430 Detect Credentials Access from Password... DET0552 Detection of Windows Service Creation or... +1 more

Actions on Objectives (18)

DET0056 Detection Strategy for Subvert Trust Con... DET0100 Behavioral Detection of Asynchronous Pro... DET0106 Behavioral Detection of PE Injection via... DET0141 Detect Time-Based Evasion via Sleep, Tim... DET0168 Virtualization/Sandbox Evasion via Syste... +13 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Operation Emmental

Type: Unknown Active

Retefe Gang Retefe Group binary planting slack space header +6 more

Infrastructure 5 IOC(s)

50%

Domain

SEKOIA.IO malware.lu webhook.site README.md 2017.md

Artifacts (32)

sdbinst.exe CMSTP.exe user32.dll Winlogon.exe ntsd.exe notepad.exe +26

Capability

50%

40 technique(s) 40 tool(s)/malware 18 CVE(s)

Aurora Backdoors BlackEnergy Carbanak Cobalt Confucius Conti Dark +32

credential access

T1555

defense impairment

T1484.002 T1553 T1553.001 T1553.002 +4

discovery

T1614.001

execution

T1047 T1053.005 T1059 T1059.001 +8

Victim

70%

Targeted Sectors

government financial-services defense energy non-profit media telecommunications critical-infrastructure aerospace oil-gas healthcare manufacturing education hospitality think-tank gaming retail utilities transportation pharmaceutical information-technology maritime chemical

Targeted Countries

US CN JP RU IN UA KP IL KR VN PK TW KZ BY IR SA GB AE MX LB IT SY FR PL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1053.005 T1059 T1059.001 T1059.003

Capability (Malware)

Aurora Backdoors BlackEnergy

Infrastructure

SEKOIA.IO malware.lu webhook.site

5 Installation

Capability (Techniques)

T1555 T1614.001 T1037.001 T1543.003 T1547.001

Capability (Malware)

Aurora Backdoors BlackEnergy

Infrastructure

SEKOIA.IO malware.lu webhook.site