Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Sea Turtle (threat actor)

Risk

Critical

27 techniques 10 tools/malware 0 vulnerabilities 7 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.002

DNS Server resource development

T1583.003

Virtual Private Server resource development

T1584.002

DNS Server resource development

T1588.002

Tool resource development

T1588.004

Digital Certificates resource development

T1608.003

Install Digital Certificate resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1199

Trusted Relationship initial access

T1566

Phishing initial access

›

4 Exploitation

T1059.004

Unix Shell execution

T1203

Exploitation for Client Execution execution

›

5 Installation

T1557

Adversary-in-the-Middle credential access

T1133

External Remote Services persistence

T1505.003

Web Shell persistence

›

6 Command & Control

T1074.002

Remote Data Staging collection

T1114.001

Local Email Collection collection

T1213.006

Databases collection

T1560.001

Archive via Utility collection

T1071.001

Web Protocols command and control

›

7 Actions on Objectives

T1685.006

Clear Linux or Mac System Logs defense impairment

T1690

Prevent Command History Logging defense impairment

T1027.004

Compile After Delivery stealth

T1078

Valid Accounts stealth

T1078.003

Local Accounts stealth

T1564.011

Ignore Process Interrupts stealth

Stage risk: Critical High Medium None

Tools & Malware (10)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617 CVE-2017-3881 CVE-2017-6736 CVE-2018-0296 CVE-2018-7600 DNS hijacking Drupalgeddon SnappyTCP

Indicators of Compromise (7)

Domain

lo0.systemctl.network forward.boord.info

IPv4 Address

193.34.167.245 82.102.19.88 95.179.176.250 93.115.22.212 62.115.255.163

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (16)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more

Exploitation (4)

M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention +5 more

Command & Control (8)

M1017 User Training M1018 User Account Management M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information +3 more

Actions on Objectives (13)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +8 more

Detection Coverage

27 strategies

6/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0840 Detection of Install Digital Certificate DET0848 Detection of Digital Certificates DET0852 Detection of Tool DET0862 Detection of DNS Server +3 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0488 Detect abuse of Trusted Relationships (t...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (3)

DET0296 Detect Adversary-in-the-Middle via Netwo... DET0354 Behavior-chain detection for T1133 Exter... DET0394 Web Shell Detection via Server Behavior...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0047 Detect Local Email Collection via Outloo... DET0071 Detection of Remote Data Staging Prior t... DET0242 Suspicious Database Access and Dump Acti... DET0298 Detect Archiving via Utility (T1560.001)

Actions on Objectives (6)

DET0067 Detection Strategy for Ignore Process In... DET0407 Detection of Local Account Abuse for Ini... DET0501 Detection Strategy for Compile After Del... DET0520 Behavioral Detection of Log File Clearin... DET0560 Detection of Valid Account Abuse Across... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Sea Turtle

Type: Unknown Active

Teal Kurma Marbled Dust Cosmic Wolf SILICON UNC1326

Infrastructure 7 IOC(s)

50%

Domain

lo0.systemctl.network forward.boord.info

IPv4 Address

193.34.167.245 82.102.19.88 95.179.176.250 93.115.22.212 62.115.255.163

Capability

90%

27 technique(s) 10 tool(s)/malware

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617 CVE-2017-3881 CVE-2017-6736 CVE-2018-0296 CVE-2018-7600 DNS hijacking +2

collection

T1074.002 T1114.001 T1213.006 T1560.001

command and control

T1071.001

credential access

T1557

defense impairment

T1685.006 T1690

Victim

70%

Targeted Sectors

energy defense government

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.002 T1583.003 T1584.002

Capability (Malware)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617

Infrastructure

lo0.systemctl.network forward.boord.info 193.34.167.245

3 Delivery

Capability (Techniques)

T1190 T1199 T1566

Capability (Malware)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617

Infrastructure

lo0.systemctl.network forward.boord.info 193.34.167.245

4 Exploitation

Capability (Techniques)

T1059.004 T1203

Capability (Malware)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617

Infrastructure

lo0.systemctl.network forward.boord.info 193.34.167.245

5 Installation

Capability (Techniques)

T1557 T1133 T1505.003

Capability (Malware)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617

Infrastructure

lo0.systemctl.network forward.boord.info 193.34.167.245

6 Command & Control

Capability (Techniques)

T1074.002 T1114.001 T1213.006 T1560.001 T1071.001

Capability (Malware)

CVE-2009-1151 CVE-2014-6271 CVE-2017-12617

Infrastructure

lo0.systemctl.network forward.boord.info 193.34.167.245