Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0154 (threat actor)
Risk
91
Critical
40 techniques 40 tools/malware 2 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
5
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1585
Establish Accounts resource development
T1586
Compromise Accounts resource development
T1587
Develop Capabilities resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
7
T1059
Command and Scripting Interpreter execution
T1059.003
Windows Command Shell execution
T1106
Native API execution
T1204.001
Malicious Link execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2013-3906
CVE CVE-2014-4114
›
5 Installation
9
T1110
Brute Force credential access
T1555
Credentials from Password Stores credential access
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
T1554
Compromise Host Software Binary persistence
›
6 Command & Control
9
T1005
Data from Local System collection
T1213
Data from Information Repositories collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1132
Data Encoding command and control
T1219
Remote Access Tools command and control
T1572
Protocol Tunneling command and control
T1573.001
Symmetric Cryptography command and control
›
7 Actions on Objectives
10
T1484
Domain or Tenant Policy Modification defense impairment
T1685
Disable or Modify Tools defense impairment
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1491
Defacement impact
T1499
Endpoint Denial of Service impact
T1561
Disk Wipe impact
T1657
Financial Theft impact
T1055
Process Injection stealth
T1140
Deobfuscate/Decode Files or Information stealth
Stage risk: Critical High Medium None

Tools & Malware (40)

APT38 Akira Backdoors Beacon BlackByte BlackCat BlackEnergy BlackSuit CaddyWiper Cobalt Cobalt Strike Conti Cyclops Cyclops Blink Dark Global Group Policy Industroyer Kimsuky LockBit Lynx Merlin Mimikatz MuddyWater Mythic NotPetya OilRig Payload Phishing emails PowerShell Prestige Remote access tools Royal Rundll32 STOP Unknown Void Windows Command Shell Winnti phishing

Indicators of Compromise (38)

Domain
TEMP.Zagros FONTCACHE.DAT putdrive.com s1.txt NTUSER.log desktop.ini multi-user.target TEMP.Akapav +11 more
Email Address
rocke@live.cn cert-ua@ukr.net
Filename
ctlhost.exe rundll32.exe svchost.exe scilc.exe M.E.Doc wbadmin.exe vssadmin.exe msserver.exe +9 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Installation (17)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies +12 more
Command & Control (13)
M1017 User Training M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1034 Limit Hardware Installation +8 more
Actions on Objectives (13)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +8 more

Detection Coverage

40 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (5)

DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (5)

DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0345 Detection Strategy for Abuse Elevation C... DET0516 Behavioral Detection of Command and Scri... DET0529 Behavioral Detection of Native API Invoc...

Installation (9)

DET0096 Account Manipulation Behavior Chain Dete... DET0336 Detect Compromise of Host Software Binar... DET0354 Behavior-chain detection for T1133 Exter... DET0370 Recursive Enumeration of Files and Direc... DET0430 Detect Credentials Access from Password... +4 more

Command & Control (9)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0108 Detection Strategy for Data Encoding in... DET0143 Detection Strategy for Encrypted Channel... DET0380 Detection of Local Data Collection Prior... +4 more

Actions on Objectives (10)

DET0137 Detection Strategy for Disk Wipe via Dir... DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... DET0215 Detection of Multi-Platform File Encrypt... DET0238 Defacement via File and Web Content Modi... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0154

Type: Unknown Active
BlackCat Winter Vivern to target Sandworm Team Operation Cleaver Shell Crew +14 more
Infrastructure 19 IOC(s)
50%
Domain
TEMP.Zagros FONTCACHE.DAT putdrive.com s1.txt NTUSER.log +14
Artifacts (19)
rocke@live.cn cert-ua@ukr.net ctlhost.exe rundll32.exe svchost.exe scilc.exe +13
Capability
50%
40 technique(s) 40 tool(s)/malware 2 CVE(s)
APT38 Akira Backdoors Beacon BlackByte BlackCat BlackEnergy BlackSuit +32
collection
T1005 T1213
command and control
T1071 T1071.001 T1105 T1132 +3
credential access
T1110 T1555
defense impairment
T1484 T1685
Victim
70%

Targeted Sectors

government financial-services defense telecommunications education healthcare manufacturing media energy critical-infrastructure non-profit hospitality retail pharmaceutical aviation aerospace transportation information-technology chemical think-tank gaming mining legal-services nuclear entertainment maritime construction oil-gas utilities food-agriculture

Targeted Countries

UA CN US RU IR GB AU VN IN JP PK TW IL SA DE AE PL BY SG KR KP CA TR MX ES RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

APT38 Akira Backdoors
2 Weaponization

Capability (Malware)

APT38 Akira Backdoors
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APT38 Akira Backdoors
4 Exploitation

Capability (Malware)

APT38 Akira Backdoors
5 Installation

Capability (Malware)

APT38 Akira Backdoors
6 Command & Control

Capability (Malware)

APT38 Akira Backdoors
7 Actions on Objectives

Capability (Malware)

APT38 Akira Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.