Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Wassonite (threat actor)

Risk

High

33 techniques 34 tools/malware 0 vulnerabilities 6 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590

Gather Victim Network Information reconnaissance

T1592

Gather Victim Host Information reconnaissance

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.003

Windows Command Shell execution

T1129

Shared Modules execution

›

5 Installation

T1012

Query Registry discovery

T1016

System Network Configuration Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1217

Browser Information Discovery discovery

T1543

Create or Modify System Process persistence

T1543.003

Windows Service persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1005

Data from Local System collection

T1056

Input Capture collection

T1056.001

Keylogging collection

T1074

Data Staged collection

T1074.001

Local Data Staging collection

T1560

Archive Collected Data collection

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1027.009

Embedded Payloads stealth

T1036

Masquerading stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1542

Pre-OS Boot stealth

T1574

Hijack Execution Flow stealth

Stage risk: Critical High Medium None

Tools & Malware (34)

AppleSeed BANSHEE BLINDINGCAN BirdCall Black Energy Bureau 121 CALENDAR DTrack Dark DarkGate DarkGate malware Dtrack FileZilla Ghost RAT Global Hidden Cobra Kimsuky Labyrinth Chollima Mimikatz Payload Payload PlugX Poison Ivy Process Hollowing SUNBURST SolarWinds Temp.Firework Trojan Unknown WAVESHAPER Wicked Windows Command Shell ipconfig rock

Indicators of Compromise (6)

Domain

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov TEMP.Firework

Filename

cmd.exe enterprise-attack-v17.1-software.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (9)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +4 more

Command & Control (4)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit M1057 Data Loss Prevention

Actions on Objectives (22)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +17 more

Detection Coverage

33 strategies

5/7 stages covered

Reconnaissance (2)

DET0826 Detection of Gather Victim Host Informat... DET0869 Detection of Gather Victim Network Infor...

Exploitation (3)

DET0018 Behavior-chain, platform-aware detection... DET0202 Behavioral Detection of Windows Command... DET0516 Behavioral Detection of Command and Scri...

Installation (10)

DET0013 Detection of Local Browser Artifact Acce... DET0034 Detection of Adversarial Process Discove... DET0195 Behavioral Detection of System Network C... DET0209 Detection of Registry Query for Environm... DET0274 Boot or Logon Autostart Execution Detect... +5 more

Command & Control (7)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0261 Detection of Local Data Staging Prior to... +2 more

Actions on Objectives (11)

DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0184 Behavioral Detection of Indicator Remova... DET0214 Detection Strategy for Embedded Payloads DET0218 Detection Strategy for Hijack Execution... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Wassonite

Type: Unknown Active

Silent Chollima Stonefly Onyx Sleet DarkSeoul TEMP.Firework +4 more

Infrastructure 4 IOC(s)

50%

Domain

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov TEMP.Firework

Artifacts (2)

cmd.exe enterprise-attack-v17.1-software.xlsx

Capability

50%

33 technique(s) 34 tool(s)/malware

AppleSeed BANSHEE BLINDINGCAN BirdCall Black Energy Bureau 121 CALENDAR DTrack +26

collection

T1005 T1056 T1056.001 T1074 +2

command and control

T1105

discovery

T1012 T1016 T1049 T1057 +3

execution

T1059 T1059.003 T1129

Victim

70%

Targeted Sectors

nuclear manufacturing financial-services energy defense government oil-gas maritime food-agriculture media critical-infrastructure

Targeted Countries

IN KR JP KP RU CN IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590 T1592

Capability (Malware)

AppleSeed BANSHEE BLINDINGCAN

Infrastructure

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov

4 Exploitation

Capability (Techniques)

T1059 T1059.003 T1129

Capability (Malware)

AppleSeed BANSHEE BLINDINGCAN

Infrastructure

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov

5 Installation

Capability (Techniques)

T1012 T1016 T1049 T1057 T1082

Capability (Malware)

AppleSeed BANSHEE BLINDINGCAN

Infrastructure

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov

6 Command & Control

Capability (Techniques)

T1005 T1056 T1056.001 T1074 T1074.001

Capability (Malware)

AppleSeed BANSHEE BLINDINGCAN

Infrastructure

demo-cloud.space vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov