Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC5537 (threat actor)

Risk

Critical

21 techniques 40 tools/malware 3 vulnerabilities 17 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059

Command and Scripting Interpreter execution

T1569

System Services execution

T1569.002

Service Execution execution

CVE CVE-2023-34362

CVE CVE-2023-51662

CVE CVE-2024-36401

›

5 Installation

T1110.004

Credential Stuffing credential access

T1555

Credentials from Password Stores credential access

T1555.001

Keychain credential access

T1555.002

Securityd Memory credential access

T1555.003

Credentials from Web Browsers credential access

T1555.004

Windows Credential Manager credential access

T1555.005

Password Managers credential access

T1555.006

Cloud Secrets Management Stores credential access

›

6 Command & Control

T1213

Data from Information Repositories collection

T1213.001

Confluence collection

T1213.002

Sharepoint collection

T1213.003

Code Repositories collection

T1213.004

Customer Relationship Management Software collection

T1213.005

Messaging Applications collection

T1213.006

Databases collection

›

7 Actions on Objectives

T1489

Service Stop impact

T1027.013

Encrypted/Encoded File stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

Astaroth Backdoors Carberp DarkGate EVILNUM GlassWorm Global Infostealer Infostealer malware Interlock LaZagne Leverage Lokibot Malware Manjusaka Medusa MetaStealer MgBot Mimikatz Mispadu MuddyWater MySQL NETWIRE PLEAD Phishing emails PinchDuke PowerShell QuasarRAT RedLine RisePro STOP SUNBURST SentinelOne Singularity SolarWinds TeamPCP Cloud Stealer Turla Vidar Zero-day exploits phishing

Indicators of Compromise (17)

Domain

Passport.Net running.Find Agent.btz login.keychain form.Business group.com.apple.notes NoteStore.sqlite my.cnf +3 more

Filename

sqlcmd.exe isql.exe explorer.exe mongorc.js

IPv4 Address

45.27.26.205 37.19.210.21

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1033 Limit Software Installation +6 more

Installation (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +5 more

Command & Control (7)

M1017 User Training M1018 User Account Management M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information M1047 Audit +2 more

Actions on Objectives (7)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1030 Network Segmentation M1040 Behavior Prevention on Endpoint +2 more

Detection Coverage

21 strategies

4/7 stages covered

Exploitation (4)

DET0279 Detection Strategy for System Services a... DET0364 Behavioral Detection Strategy for WMI Ex... DET0421 Detection Strategy for System Services S... DET0516 Behavioral Detection of Command and Scri...

Installation (8)

DET0037 Detect Suspicious Access to Browser Cred... DET0057 Detect Suspicious Access to securityd Me... DET0130 Detect Unauthorized Access to Cloud Secr... DET0134 Detect Suspicious Access to Windows Cred... DET0396 Detect Access to macOS Keychain for Cred... +3 more

Command & Control (7)

DET0242 Suspicious Database Access and Dump Acti... DET0263 Detecting Bulk or Anomalous Access to Pr... DET0358 Programmatic and Excessive Access to Con... DET0413 Abuse of Information Repositories for Da... DET0500 Detecting Abnormal SharePoint Data Minin... +2 more

Actions on Objectives (2)

DET0021 Behavioral Detection for Service Stop ac... DET0087 Encrypted or Encoded File Payload Detect...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC5537

Type: Unknown Active

LdPinch Judische the UNC5537 attack Octo Tempest UNC3944 +1 more

Infrastructure 13 IOC(s)

50%

Domain

Passport.Net running.Find Agent.btz login.keychain form.Business +6

IPv4 Address

45.27.26.205 37.19.210.21

Artifacts (4)

sqlcmd.exe isql.exe explorer.exe mongorc.js

Capability

50%

21 technique(s) 40 tool(s)/malware 3 CVE(s)

Astaroth Backdoors Carberp DarkGate EVILNUM GlassWorm Global Infostealer +32

collection

T1213 T1213.001 T1213.002 T1213.003 +3

credential access

T1110.004 T1555 T1555.001 T1555.002 +4

execution

T1047 T1059 T1569 T1569.002

impact

T1489

Victim

70%

Targeted Sectors

financial-services healthcare defense telecommunications government non-profit gaming aviation retail manufacturing utilities energy transportation oil-gas think-tank information-technology

Targeted Countries

AU RU PL SA AE UA NL US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1059 T1569 T1569.002

Capability (Malware)

Astaroth Backdoors Carberp

Infrastructure

Passport.Net running.Find Agent.btz

5 Installation

Capability (Techniques)

T1110.004 T1555 T1555.001 T1555.002 T1555.003

Capability (Malware)

Astaroth Backdoors Carberp

Infrastructure

Passport.Net running.Find Agent.btz

6 Command & Control

Capability (Techniques)

T1213 T1213.001 T1213.002 T1213.003 T1213.004

Capability (Malware)

Astaroth Backdoors Carberp

Infrastructure

Passport.Net running.Find Agent.btz

7 Actions on Objectives

Capability (Techniques)

T1489

Capability (Malware)

Astaroth Backdoors Carberp

Infrastructure

Passport.Net running.Find Agent.btz