Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

IcePeony (threat actor)

Risk

High

10 techniques 41 tools/malware 0 vulnerabilities 19 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1204.004

Malicious Copy and Paste execution

›

5 Installation

No data

›

6 Command & Control

T1114.003

Email Forwarding Rule collection

T1530

Data from Cloud Storage collection

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1078.004

Cloud Accounts stealth

T1564.008

Email Hiding Rules stealth

Stage risk: Critical High Medium None

Tools & Malware (41)

AnyDesk AppDomainManager Avaddon BITS Backdoors Careto ConnectWise Custom malware Fleetdeck Global Group Policy Hook Hunter Interception KongTuke Leverage LummaC2 MESHAGENT MSBuild Matrix MeshCentral MintsLoader Netsupport Manager Nexus Phyishing PowerShell Process Hollowing Quick Assist Remote access tools Rhadamanthys STOP SimpleHelp SocGholish TeamViewer Unknown Windows Command Shell mshta mshta.exe netsh phishing systemd

Indicators of Compromise (19)

Domain

demo-cloud.space cisa.gov Hunt.io spur.us Level.io level.io vscode.dev

Email Address

info@redcanary.com

Filename

simpplehelp.exe host.exe srservice.exe pcideply.exe ateraagent.exe pcilic.exe mshta.exe quickassist.exe +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Command & Control (9)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +4 more

Actions on Objectives (10)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +5 more

Detection Coverage

10 strategies

3/7 stages covered

Exploitation (4)

DET0340 User Execution – Malicious Copy & Paste... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Command & Control (3)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0484 Multi-Platform Cloud Storage Exfiltratio... DET0576 Email Forwarding Rule Abuse Detection Ac...

Actions on Objectives (3)

DET0192 Detection Strategy for Email Hiding Rule... DET0378 Behavioral Detection of Obfuscated Files... DET0546 Detection of Abused or Compromised Cloud...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

IcePeony

Type: Unknown Active

Careto Synaptics worm

Infrastructure 7 IOC(s)

50%

Domain

demo-cloud.space cisa.gov Hunt.io spur.us Level.io +2

Artifacts (12)

info@redcanary.com simpplehelp.exe host.exe srservice.exe pcideply.exe ateraagent.exe +6

Capability

50%

10 technique(s) 41 tool(s)/malware

AnyDesk AppDomainManager Avaddon BITS Backdoors Careto ConnectWise Custom malware +33

collection

T1114.003 T1530

command and control

T1105

execution

T1047 T1059 T1059.001 T1204.004

stealth

T1027 T1078.004 T1564.008

Victim

70%

Targeted Sectors

government defense education financial-services telecommunications critical-infrastructure manufacturing energy media

Targeted Countries

CN KP PL PK IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1059 T1059.001 T1204.004

Capability (Malware)

AnyDesk AppDomainManager Avaddon

Infrastructure

demo-cloud.space cisa.gov Hunt.io

6 Command & Control

Capability (Techniques)

T1114.003 T1530 T1105

Capability (Malware)

AnyDesk AppDomainManager Avaddon

Infrastructure

demo-cloud.space cisa.gov Hunt.io