Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC1860 (threat actor)

Risk

High

8 techniques 51 tools/malware 2 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2017-11882

CVE CVE-2019-0604

›

5 Installation

T1110

Brute Force credential access

›

6 Command & Control

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1485

Data Destruction impact

T1014

Rootkit stealth

Stage risk: Critical High Medium None

Tools & Malware (51)

AppDomainManager BASEWALK backdoor BITS BLINDINGCAN BONDUPDATER Backdoors Clayslide Cobalt DNSpionage DistTrack Group Policy Havex RAT Havoc Helminth Helminth backdoor Hook ISMAgent ISMDoor ISMInjector Interception Leverage LoJax Lynx MSBuild OATBOAT loader OilRig PICKPOCKET PLAY POWRUNER PowerShell Process Hollowing RGDoor ROADSWEEP SASHEYAWAY dropper STAYSHANTE web shell Saitama backdoor SideTwist SideTwist trojan variant TEMPLEDOOR TEMPLEPLAY framework Trojan TwoFace VIROGREEN framework W32.Disttrack (Shamoon) WINTAPIX kernel driver Web Shell Web Shells ZeroCleare netsh phishing systemd

Indicators of Compromise (40)

Domain

Trojan.Filerase pe.subsystem cisa.gov 1.txt pe.imphash W32.Disttrack demo-cloud.space

MD5 Hash

57cd8e220465aa8030755d4009d0117c caffdb648a0a68cd36694f0f0c7699d7 6d3041b89484c273376e5189e190d235 0c93cac9854831da5f761ee98bb40c37 1176381da7dea356f3377a59a6f0e799 41f4732ed369f2224a422752860b0bc5 4029bc4a06638bb9ac4b8528523b72f6 126bc1c30fba27f8bf67dce4892b1e8c +25 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (8)

M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1048 Application Isolation and Sandboxing +3 more

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication +3 more

Actions on Objectives (3)

M1018 User Account Management M1032 Multi-factor Authentication M1053 Data Backup

Detection Coverage

8 strategies

5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (1)

DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0327 Multi-event Detection Strategy for RDP-B...

Actions on Objectives (2)

DET0146 Detection of Data Destruction Across Pla... DET0377 Detection of Kernel/User-Level Rootkit B...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC1860

Type: Unknown Active

APT34 TEMPLEPLAY UNC961 Scarred Manticore Storm-0861

Infrastructure 7 IOC(s)

50%

Domain

Trojan.Filerase pe.subsystem cisa.gov 1.txt pe.imphash +2

Artifacts (33)

Capability

50%

8 technique(s) 51 tool(s)/malware 2 CVE(s)

AppDomainManager BASEWALK backdoor BITS BLINDINGCAN BONDUPDATER Backdoors Clayslide Cobalt +43

credential access

T1110

execution

T1059.001 T1203

impact

T1485

initial access

T1190 T1566.001

Victim

70%

Targeted Sectors

government financial-services telecommunications critical-infrastructure energy education defense utilities manufacturing chemical aviation oil-gas healthcare hospitality information-technology transportation retail media

Targeted Countries

IR IL US SA IQ TR LB AU BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AppDomainManager BASEWALK backdoor BITS

Infrastructure

Trojan.Filerase pe.subsystem cisa.gov

4 Exploitation

Capability (Techniques)

T1059.001 T1203

Capability (Malware)

AppDomainManager BASEWALK backdoor BITS

Infrastructure

Trojan.Filerase pe.subsystem cisa.gov

5 Installation

Capability (Techniques)

T1110

Capability (Malware)

AppDomainManager BASEWALK backdoor BITS

Infrastructure

Trojan.Filerase pe.subsystem cisa.gov

6 Command & Control

Capability (Techniques)

T1021.001

Capability (Malware)

AppDomainManager BASEWALK backdoor BITS

Infrastructure

Trojan.Filerase pe.subsystem cisa.gov

7 Actions on Objectives

Capability (Techniques)

T1485

Capability (Malware)

AppDomainManager BASEWALK backdoor BITS

Infrastructure

Trojan.Filerase pe.subsystem cisa.gov