Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

USDoD (threat actor)

Risk

Medium

1 techniques 24 tools/malware 0 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1567.002

Exfiltration to Cloud Storage exfiltration

Stage risk: Critical High Medium None

Tools & Malware (24)

Astaroth Backdoors CALENDAR ClickOnce Cursor Custom malware Dark Expand GlassWorm Global Globe Hunter Impacket Malware Ransomware variants Roboto STOP SUNBURST SentinelOne SolarWinds Trojan Zscaler barkiofork phishing

Indicators of Compromise (40)

Domain

b.aqdrmf aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-r08add.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-E6eRQd.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-gk6SMd.aqdrmf +32 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

1 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (1)

M1021 Restrict Web-Based Content

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

USDoD

Type: Unknown Active

EquationCorp

Infrastructure 40 IOC(s)

50%

Domain

b.aqdrmf aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf +35

Capability

50%

1 technique(s) 24 tool(s)/malware

Astaroth Backdoors CALENDAR ClickOnce Cursor Custom malware Dark Expand +16

exfiltration

T1567.002

Victim

70%

Targeted Sectors

defense government transportation pharmaceutical financial-services media

Targeted Countries

CN TW IR US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1567.002

Capability (Malware)

Astaroth Backdoors CALENDAR

Infrastructure

b.aqdrmf aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf