Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT12 (threat actor)

Risk

Medium

5 techniques 10 tools/malware 0 vulnerabilities 0 IOCs 3/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

›

5 Installation

No data

›

6 Command & Control

T1102.002

Bidirectional Communication command and control

T1568.003

DNS Calculation command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (10)

3001 EtumBot Gh0st Hightide Ixeshe Mswab RIPTIDE ShowNews ThreeByte WaterSpout

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more

Command & Control (2)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention

Detection Coverage

5 strategies

3/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down...

Command & Control (2)

DET0035 Detect Bidirectional Web Service C2 Chan... DET0262 Detection Strategy for Dynamic Resolutio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

APT12

Type: Unknown Active

IXESHE DynCalc Numbered Panda DNSCALC TG-2754 (tentative) +8 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

5 technique(s) 10 tool(s)/malware

3001 EtumBot Gh0st Hightide Ixeshe Mswab RIPTIDE ShowNews +2

command and control

T1102.002 T1568.003

execution

T1203 T1204.002

initial access

T1566.001

Victim

70%

Targeted Sectors

telecommunications critical infrastructure government

Targeted Countries

TW JP

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

3001 EtumBot Gh0st

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1203 T1204.002

Capability (Malware)

3001 EtumBot Gh0st

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1102.002 T1568.003

Capability (Malware)

3001 EtumBot Gh0st

Infrastructure

No infra linked