Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

R00tK1T (threat actor)

Risk

Medium

3 techniques 40 tools/malware 0 vulnerabilities 2 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1548.002

Bypass User Account Control privilege escalation

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

Stage risk: Critical High Medium None

Tools & Malware (40)

Akira AppDomainManager Ares AutoIt BITS BITS Jobs BQTlock Bjorka ClickOnce Dark Global Group Policy Gunra HAVEX RAT Hook Hooks Interception JamPlus Kernel modules LockBit Lynx MSBuild Malware Matrix Msiexec Netsh PowerShell Process Hollowing Rootkit Rundll32 SUNBURST Systemd Telegram Telegram channels Windows Command Shell inter mshta phishing regasm web shell

Indicators of Compromise (2)

Domain

fee.It

Filename

Attack-Report-on-Aviation-Industry.pdf

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (4)

M1026 Privileged Account Management M1047 Audit M1051 Update Software M1052 User Account Control

Actions on Objectives (4)

M1017 User Training M1018 User Account Management M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

3 strategies

2/7 stages covered

Exploitation (1)

DET0388 Detection Strategy for T1548.002 – Bypas...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

R00tK1T

Type: Unknown Active

ALTDOS GHOSTR 0mid16b Anime ghostr

Infrastructure 1 IOC(s)

50%

Domain

fee.It

Artifacts (1)

Attack-Report-on-Aviation-Industry.pdf

Capability

50%

3 technique(s) 40 tool(s)/malware

Akira AppDomainManager Ares AutoIt BITS BITS Jobs BQTlock Bjorka +32

impact

T1486 T1657

privilege escalation

T1548.002

Victim

70%

Targeted Sectors

media financial-services telecommunications aviation aerospace energy government defense education manufacturing retail

Targeted Countries

CN PK

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1548.002

Capability (Malware)

Akira AppDomainManager Ares

Infrastructure

fee.It

7 Actions on Objectives

Capability (Techniques)

T1486 T1657

Capability (Malware)

Akira AppDomainManager Ares

Infrastructure

fee.It