Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0185 (threat actor)
Risk
91
Critical
49 techniques 49 tools/malware 21 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
32
T1059.003
Windows Command Shell execution
T1059.013
Container CLI/API execution
T1129
Shared Modules execution
T1204
User Execution execution
T1559
Inter-Process Communication execution
T1559.001
Component Object Model execution
T1559.002
Dynamic Data Exchange execution
T1559.003
XPC Services execution
T1610
Deploy Container execution
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2018-0802
CVE CVE-2019-9621
CVE CVE-2019-9670
CVE CVE-2021-26855
CVE CVE-2021-26857
CVE CVE-2021-27065
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-3236
CVE CVE-2022-37969
CVE CVE-2023-22515
CVE CVE-2023-22518
CVE CVE-2023-46805
CVE CVE-2023-48788
CVE CVE-2024-21887
CVE CVE-2024-27198
CVE CVE-2024-49039
CVE CVE-2024-9680
›
5 Installation
7
T1558.001
Golden Ticket credential access
T1558.004
AS-REP Roasting credential access
T1124
System Time Discovery discovery
T1135
Network Share Discovery discovery
T1518.002
Backup Software Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1133
External Remote Services persistence
›
6 Command & Control
12
T1123
Audio Capture collection
T1125
Video Capture collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1560.002
Archive via Library collection
T1560.003
Archive via Custom Method collection
T1071
Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1132.002
Non-Standard Encoding command and control
T1550
Use Alternate Authentication Material lateral movement
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
16
T1490
Inhibit System Recovery impact
T1498
Network Denial of Service impact
T1055
Process Injection stealth
T1127
Trusted Developer Utilities Proxy Execution stealth
T1127.001
MSBuild stealth
T1127.002
ClickOnce stealth
T1127.003
JamPlus stealth
T1134
Access Token Manipulation stealth
T1134.001
Token Impersonation/Theft stealth
T1134.002
Create Process with Token stealth
T1134.003
Make and Impersonate Token stealth
T1134.004
Parent PID Spoofing stealth
T1134.005
SID-History Injection stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1063
T1063
T1172
T1172
Stage risk: Critical High Medium None

Tools & Malware (49)

AHK Bot ANDROMEDA Akira Ande Loader AnyDesk BianLian BianLian Ransomware CSharp‑Streamer‑RAT Cobalt Cobalt Strike Global Group Policy Hook Interception Interlock LockBit LockBit 3.0 MESHAGENT Medusa MetaStealer Payload Payload Phishing Kit Phishing campaigns Phishing emails PowerShell Rclone RedLine Remote Utilities Remote access tools Rhadamanthys Rogue Rootkit Rundll32 STOP ScreenShotter SmokeLoader Telegram Tomiris Turla UltraVNC Unknown WasabiSeed WhatsApp Windows Command Shell mshta ngrok phishing systemd

Indicators of Compromise (40)

Domain
demo-cloud.space NTDS.dit macOS.OSAMiner BI.ZONE Trojan-Spy.VBS.Unicorn vnd.openxmlformats-officedocument.spreadsheetml.sheet signal-groups.tech document.getElementById +11 more
Filename
VsGraphicsDesktopEngine.exe rc.exe mstsc.exe cmd.exe rundll32.exe svchost.exe hh.exe enterprise-attack-v17.1-software.xlsx +13 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (19)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more
Installation (13)
M1015 Active Directory Configuration M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +8 more
Command & Control (11)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +6 more
Actions on Objectives (11)
M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +6 more

Detection Coverage

47 strategies
5/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (11)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... +6 more

Installation (7)

DET0088 Backup Software Discovery via CLI, Regis... DET0112 Boot or Logon Initialization Scripts Det... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0144 Detect Forged Kerberos Golden Tickets (T... DET0151 Behavior-chain, platform-aware detection... +2 more

Command & Control (12)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... +7 more

Actions on Objectives (14)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0275 Detect Adversary Deobfuscation or Decodi... DET0283 Behavior-chain detection for T1134 Acces... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0185

Type: Unknown Active
UNC4221 UAC-0195 Winter Vivern to target Synaptics worm APT33 +42 more
Infrastructure 19 IOC(s)
50%
Domain
demo-cloud.space NTDS.dit macOS.OSAMiner BI.ZONE Trojan-Spy.VBS.Unicorn +14
Artifacts (21)
VsGraphicsDesktopEngine.exe rc.exe mstsc.exe cmd.exe rundll32.exe svchost.exe +15
Capability
50%
49 technique(s) 49 tool(s)/malware 21 CVE(s)
AHK Bot ANDROMEDA Akira Ande Loader AnyDesk BianLian BianLian Ransomware CSharp‑Streamer‑RAT +41
T1063 T1172
collection
T1123 T1125 T1560 T1560.001 +2
command and control
T1071 T1105 T1132.001 T1132.002
credential access
T1558.001 T1558.004
Victim
70%

Targeted Sectors

defense government financial-services manufacturing telecommunications energy pharmaceutical transportation critical-infrastructure construction education healthcare media food-agriculture chemical retail non-profit maritime mining aviation

Targeted Countries

RU UA DE IN PK CN IR US TR KP KR JP IT VN BR TW SA AE FR CA AU GB BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566 T1566.001

Capability (Malware)

AHK Bot ANDROMEDA Akira
4 Exploitation

Capability (Malware)

AHK Bot ANDROMEDA Akira
5 Installation

Capability (Malware)

AHK Bot ANDROMEDA Akira
6 Command & Control

Capability (Malware)

AHK Bot ANDROMEDA Akira
7 Actions on Objectives

Capability (Techniques)

T1490 T1498

Capability (Malware)

AHK Bot ANDROMEDA Akira
Leaving Threaticon

This link opens an external site that isn't part of the platform.