Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
SilkSpecter (threat actor)
Risk
76
Critical
23 techniques 43 tools/malware 0 vulnerabilities 26 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
4
T1047
Windows Management Instrumentation execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1204.004
Malicious Copy and Paste execution
›
5 Installation
4
T1018
Remote System Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1098
Account Manipulation persistence
›
6 Command & Control
4
T1114.003
Email Forwarding Rule collection
T1530
Data from Cloud Storage collection
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
›
7 Actions on Objectives
10
T1486
Data Encrypted for Impact impact
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1036.001
Invalid Code Signature stealth
T1055
Process Injection stealth
T1078.004
Cloud Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1497
Virtualization/Sandbox Evasion stealth
T1564.008
Email Hiding Rules stealth
T1063
T1063
Stage risk: Critical High Medium None

Tools & Malware (43)

Agent Tesla Akira Akira ransomware BLINDINGCAN Black Basta Cannon Cobalt Cobalt Strike Emotet GitHub Global Havex RAT KongTuke Leverage LummaC2 Matrix MintsLoader MuddyWater Netsupport Manager OilRig Phishing Kit Phishing campaigns PowerShell PowerShell scripts Pyramid REPTILE Remote access tools Rhadamanthys STOP SUNBURST ScreenConnect Sednit SentinelOne SocGholish Sofacy SolarWinds Spear-phishing Spear‑phishing Kit Trojan WAVESHAPER Windows Command Shell YARA phishing

Indicators of Compromise (26)

Domain
amazon-shopping-deals.com wistia.com U.S.News search.Prefer kit.csv blackfriday-shoe.top eu-blochdance.shop ikea-euonline.com +12 more
Email Address
info@redcanary.com
Filename
ed.pdf trusttollsvg.js collect.js
SHA-256 Hash
587b05cd8d59f9820d2cf168b07d46b1519d12ee7a2f7062a2490da0a99ccb50 9a049fe87fe472bd6e2a9f361b78a64576be9f827f9668af69bec03f5cbef0da

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (11)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more
Installation (7)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +2 more
Command & Control (11)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1034 Limit Hardware Installation +6 more
Actions on Objectives (14)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Detection Coverage

22 strategies
5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0340 User Execution – Malicious Copy & Paste... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (4)

DET0096 Account Manipulation Behavior Chain Dete... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U... DET0574 Detection Strategy for Remote System Enu...

Command & Control (4)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0484 Multi-Platform Cloud Storage Exfiltratio... DET0496 Behavior-Chain Detection for Remote Acce... DET0576 Email Forwarding Rule Abuse Detection Ac...

Actions on Objectives (9)

DET0031 Invalid Code Signature Execution Detecti... DET0046 Detection Strategy for T1497 Virtualizat... DET0127 Behavioral Detection of Masquerading Acr... DET0192 Detection Strategy for Email Hiding Rule... DET0215 Detection of Multi-Platform File Encrypt... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

SilkSpecter

Type: Unknown Active
APT28 Pawn Storm Fancy Bear Sednit web skimmers
Infrastructure 20 IOC(s)
50%
Domain
amazon-shopping-deals.com wistia.com U.S.News search.Prefer kit.csv +15
Artifacts (6)
info@redcanary.com ed.pdf trusttollsvg.js collect.js 587b05cd8d59f9820d2cf168b07d46b1519d12ee7a2f7062a2490da0a99ccb50 9a049fe87fe472bd6e2a9f361b78a64576be9f827f9668af69bec03f5cbef0da
Capability
50%
23 technique(s) 43 tool(s)/malware
Agent Tesla Akira Akira ransomware BLINDINGCAN Black Basta Cannon Cobalt Cobalt Strike +35
T1063
collection
T1114.003 T1530
command and control
T1105 T1219
discovery
T1018 T1082 T1083
Victim
70%

Targeted Sectors

financial-services defense retail government telecommunications maritime manufacturing

Targeted Countries

CN US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Agent Tesla Akira Akira ransomware
4 Exploitation

Capability (Malware)

Agent Tesla Akira Akira ransomware
5 Installation

Capability (Techniques)

T1018 T1082 T1083 T1098

Capability (Malware)

Agent Tesla Akira Akira ransomware
6 Command & Control

Capability (Malware)

Agent Tesla Akira Akira ransomware
7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

Agent Tesla Akira Akira ransomware
Leaving Threaticon

This link opens an external site that isn't part of the platform.