Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
ProCC (threat actor)
Risk
94
Critical
40 techniques 40 tools/malware 3 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1589
Gather Victim Identity Information reconnaissance
›
2 Weaponization
3
T1583
Acquire Infrastructure resource development
T1585
Establish Accounts resource development
T1588
Obtain Capabilities resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
5
T1059
Command and Scripting Interpreter execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2015-2291
CVE CVE-2021-35464
CVE CVE-2025-55182
›
5 Installation
13
T1003
OS Credential Dumping credential access
T1555
Credentials from Password Stores credential access
T1621
Multi-Factor Authentication Request Generation credential access
T1046
Network Service Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1538
Cloud Service Dashboard discovery
T1580
Cloud Infrastructure Discovery discovery
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
›
6 Command & Control
7
T1005
Data from Local System collection
T1074
Data Staged collection
T1114
Email Collection collection
T1213
Data from Information Repositories collection
T1530
Data from Cloud Storage collection
T1105
Ingress Tool Transfer command and control
T1021.007
Cloud Services lateral movement
›
7 Actions on Objectives
13
T1484
Domain or Tenant Policy Modification defense impairment
T1556
Modify Authentication Process defense impairment
T1578
Modify Cloud Compute Infrastructure defense impairment
T1685
Disable or Modify Tools defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1490
Inhibit System Recovery impact
T1657
Financial Theft impact
T1006
Direct Volume Access stealth
T1055
Process Injection stealth
T1070
Indicator Removal stealth
T1564
Hide Artifacts stealth
Stage risk: Critical High Medium None

Tools & Malware (40)

AppDomainManager Auto-Color BITS BITS Jobs CanisterWorm Chisel ClickOnce DCSync GitHub Global Group Policy Hook Hooks Infostealer Interception JamPlus Kernel modules Kubernetes Leverage Linux backdoor MSBuild Malware Microsoft Teams Netsh Payload Payload PowerShell Process Hollowing Qilin Raccoon Raccoon Stealer Remote Access Tools Rootkit Symbiote Systemd Teleport WildFire Windows Command Shell ngrok phishing

Indicators of Compromise (40)

Domain
plug-tab-protective-relay.trycloudflare.com tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io championships-peoples-point-cassette.trycloudflare.com investigation-launches-hearings-copying.trycloudflare.com souls-entire-defined-routes.trycloudflare.com create-sensitivity-grad-sequence.trycloudflare.com scan.aquasecurtiy.org Teleport.sh +8 more
Filename
iqvw64.sys kube.py tpcp.tar.gz sysmon.py package.json prop.py
SHA-256 Hash
30015DD1E2CF4DBD49FFF9DDEF2AD4622DA2E60E5C0B6228595325532E948F14 41C4F2F37C0B257D1E20FE167F2098DA9D2E0A939B09ED3F63BC4FE010F8365C 0c6a3555c4eb49f240d7e0e3edbfbb3c900f123033b4f6e99ac3724b9b76278f D8CAF4581C9F0000C7568D78FB7D2E595AB36134E2346297D78615942CBBD727 1e559c51f19972e96fcc5a92d710732159cdae72f407864607a513b20729decb 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a 0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a 5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956 +2 more
IPv4 Address
195.5.171.242 209.34.235.18 212.71.124.188 45.148.10.212 83.142.209.11 23.142.184.129 63.251.162.11 83.142.209.203

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (13)
M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +8 more
Installation (23)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +18 more
Command & Control (12)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +7 more
Actions on Objectives (23)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +18 more

Detection Coverage

40 strategies
7/7 stages covered

Reconnaissance (1)

DET0841 Detection of Gather Victim Identity Info...

Weaponization (3)

DET0850 Detection of Obtain Capabilities DET0873 Detection of Establish Accounts DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri...

Installation (13)

DET0013 Detection of Local Browser Artifact Acce... DET0096 Account Manipulation Behavior Chain Dete... DET0160 Detection Strategy for Multi-Factor Auth... DET0169 Detection Strategy for Cloud Infrastruct... DET0234 Credential Dumping via Sensitive Memory... +8 more

Command & Control (7)

DET0008 Behavioral Detection of Remote Cloud Log... DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0380 Detection of Local Data Collection Prior... DET0413 Abuse of Information Repositories for Da... +2 more

Actions on Objectives (13)

DET0104 Detect Modification of Authentication Pr... DET0184 Behavioral Detection of Indicator Remova... DET0215 Detection of Multi-Platform File Encrypt... DET0270 Detection of Domain or Tenant Policy Mod... DET0308 Detection Strategy for Modify Cloud Comp... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

ProCC

Type: Unknown Active
OilRig a tagged union sum type employees at target organizations PCPcat +2 more
Infrastructure 24 IOC(s)
50%
Domain
plug-tab-protective-relay.trycloudflare.com tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io championships-peoples-point-cassette.trycloudflare.com investigation-launches-hearings-copying.trycloudflare.com souls-entire-defined-routes.trycloudflare.com +11
IPv4 Address
195.5.171.242 209.34.235.18 212.71.124.188 45.148.10.212 83.142.209.11 +3
Artifacts (16)
iqvw64.sys kube.py tpcp.tar.gz sysmon.py package.json prop.py +10
Capability
50%
40 technique(s) 40 tool(s)/malware 3 CVE(s)
AppDomainManager Auto-Color BITS BITS Jobs CanisterWorm Chisel ClickOnce DCSync +32
collection
T1005 T1074 T1114 T1213 +1
command and control
T1105
credential access
T1003 T1555 T1621
defense impairment
T1484 T1556 T1578 T1685
Victim
70%

Targeted Sectors

financial-services government defense information-technology telecommunications healthcare manufacturing retail hospitality gaming media mining education critical-infrastructure

Targeted Countries

US IL CN DE BR IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589

Capability (Malware)

AppDomainManager Auto-Color BITS
2 Weaponization

Capability (Techniques)

T1583 T1585 T1588

Capability (Malware)

AppDomainManager Auto-Color BITS
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

AppDomainManager Auto-Color BITS
4 Exploitation

Capability (Techniques)

T1059 T1068

Capability (Malware)

AppDomainManager Auto-Color BITS
5 Installation

Capability (Malware)

AppDomainManager Auto-Color BITS
6 Command & Control

Capability (Malware)

AppDomainManager Auto-Color BITS
7 Actions on Objectives

Capability (Malware)

AppDomainManager Auto-Color BITS
Leaving Threaticon

This link opens an external site that isn't part of the platform.