Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Confucius (threat actor)

Risk

High

19 techniques 1 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.006

Web Services resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

T1203

Exploitation for Client Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

›

5 Installation

T1083

File and Directory Discovery discovery

T1680

Local Storage Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1119

Automated Collection collection

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1567.002

Exfiltration to Cloud Storage exfiltration

T1218.005

Mshta stealth

T1221

Template Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (1)

WarzoneRAT

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Command & Control (4)

M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (7)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1038 Execution Prevention M1042 Disable or Remove Feature or Program +2 more

Detection Coverage

19 strategies

6/7 stages covered

Weaponization (1)

DET0896 Detection of Web Services

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (6)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... +1 more

Installation (3)

DET0188 Local Storage Discovery via Drive Enumer... DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc...

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect...

Actions on Objectives (4)

DET0348 Detection Strategy for Exfiltration Over... DET0506 Detecting Mshta-based Proxy Execution vi... DET0566 Template Injection Detection - Windows DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Confucius

Type: Unknown Active

Confucius APT

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

19 technique(s) 1 tool(s)/malware

WarzoneRAT

collection

T1119

command and control

T1071.001 T1105

discovery

T1083 T1680

execution

T1053.005 T1059.001 T1059.005 T1203 +2

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.006

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.005 T1203 T1204.001

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1083 T1680 T1547.001

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1119 T1071.001 T1105

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1041 T1567.002

Capability (Malware)

WarzoneRAT

Infrastructure

No infra linked