Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA551 (threat actor)

Risk

High

14 techniques 4 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.002

Email Addresses reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1204.002

Malicious File execution

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1132.001

Standard Encoding command and control

T1568.002

Domain Generation Algorithms command and control

›

7 Actions on Objectives

T1027.003

Steganography stealth

T1027.010

Command Obfuscation stealth

T1036

Masquerading stealth

T1218.005

Mshta stealth

T1218.010

Regsvr32 stealth

T1218.011

Rundll32 stealth

Stage risk: Critical High Medium None

Tools & Malware (4)

IcedID QakBot Ursnif Valak

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (3)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Command & Control (3)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +5 more

Detection Coverage

14 strategies

5/7 stages covered

Reconnaissance (1)

DET0814 Detection of Email Addresses

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0419 Detection Strategy for Dynamic Resolutio...

Actions on Objectives (6)

DET0119 Detection Strategy for Steganographic Ab... DET0127 Behavioral Detection of Masquerading Acr... DET0282 Detection Strategy for System Binary Pro... DET0475 Detection Strategy for T1218.011 Rundll3... DET0505 Detection Strategy for Command Obfuscati... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

TA551

Type: Unknown Active

GOLD CABIN Shathak Shakthak TA551 ATK236 +2 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

14 technique(s) 4 tool(s)/malware

IcedID QakBot Ursnif Valak

command and control

T1071.001 T1105 T1132.001 T1568.002

execution

T1059.003 T1204.002

initial access

T1566.001

reconnaissance

T1589.002

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.002

Capability (Malware)

IcedID QakBot Ursnif

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

IcedID QakBot Ursnif

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003 T1204.002

Capability (Malware)

IcedID QakBot Ursnif

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1071.001 T1105 T1132.001 T1568.002

Capability (Malware)

IcedID QakBot Ursnif

Infrastructure

No infra linked