Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

DieNet (threat actor)

Risk

Critical

74 techniques 53 tools/malware 1 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590

Gather Victim Network Information reconnaissance

T1592

Gather Victim Host Information reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

›

4 Exploitation

T1059.013

Container CLI/API execution

T1129

Shared Modules execution

T1559

Inter-Process Communication execution

T1559.001

Component Object Model execution

T1559.002

Dynamic Data Exchange execution

T1559.003

XPC Services execution

T1610

Deploy Container execution

T1648

Serverless Execution execution

T1546.005

Trap privilege escalation

T1546.016

Installer Packages privilege escalation

T1548

Abuse Elevation Control Mechanism privilege escalation

T1548.002

Bypass User Account Control privilege escalation

T1548.005

Temporary Elevated Cloud Access privilege escalation

CVE CVE-2023-33538

›

5 Installation

T1528

Steal Application Access Token credential access

T1558

Steal or Forge Kerberos Tickets credential access

T1558.001

Golden Ticket credential access

T1558.002

Silver Ticket credential access

T1558.004

AS-REP Roasting credential access

T1621

Multi-Factor Authentication Request Generation credential access

T1124

System Time Discovery discovery

T1135

Network Share Discovery discovery

T1518.002

Backup Software Discovery discovery

T1133

External Remote Services persistence

T1136

Create Account persistence

T1136.003

Cloud Account persistence

T1505

Server Software Component persistence

T1505.001

SQL Stored Procedures persistence

T1505.002

Transport Agent persistence

T1505.004

IIS Components persistence

T1505.005

Terminal Services DLL persistence

T1525

Implant Internal Image persistence

T1546.017

Udev Rules persistence

T1547.009

Shortcut Modification persistence

T1547.010

Port Monitors persistence

T1547.015

›

6 Command & Control

T1123

Audio Capture collection

T1125

Video Capture collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1560.002

Archive via Library collection

T1560.003

Archive via Custom Method collection

T1132.001

Standard Encoding command and control

T1132.002

Non-Standard Encoding command and control

T1550

Use Alternate Authentication Material lateral movement

T1550.001

Application Access Token lateral movement

T1550.002

Pass the Hash lateral movement

T1550.003

Pass the Ticket lateral movement

›

7 Actions on Objectives

T1556.003

Pluggable Authentication Modules defense impairment

T1647

Plist File Modification defense impairment

T1490

Inhibit System Recovery impact

T1498

Network Denial of Service impact

T1127

Trusted Developer Utilities Proxy Execution stealth

T1127.001

MSBuild stealth

T1127.002

ClickOnce stealth

T1127.003

JamPlus stealth

T1134

Access Token Manipulation stealth

T1134.001

Token Impersonation/Theft stealth

T1134.002

Create Process with Token stealth

T1134.003

Make and Impersonate Token stealth

T1134.004

Parent PID Spoofing stealth

T1134.005

SID-History Injection stealth

T1218.011

Rundll32 stealth

T1218.012

Verclsid stealth

T1497

Virtualization/Sandbox Evasion stealth

T1542

Pre-OS Boot stealth

T1542.001

System Firmware stealth

T1542.002

Component Firmware stealth

T1542.004

ROMMONkit stealth

T1542.005

TFTP Boot stealth

T1622

Debugger Evasion stealth

T0835

Stage risk: Critical High Medium None

Tools & Malware (53)

BITS CL-STA-1128 ClickOnce Cobalt Custom malware Cyber Av3ngers Dark Dark Storm Team DieNet Docker DragonForce Epic Explosive Gentlemen GitHub GitHub Actions workflows Global Group Policy Handala Hook Infostealer Interception JamPlus Kubernetes Leverage MRHELL112 MSBuild MuddyWater Nexus OilRig Payload Payload PowerShell Qilin Remote access tools Rhysida Rogue Rootkit Rundll32 STOP SafePay Skeleton Key Stealc Storm-0784 Telegram VBScript WinRM Windows Command Shell inter mshta phishing systemd wmic

Indicators of Compromise (40)

Domain

submit.php Vim.org iranforward.org donations.Figure emiratescryptobank.com.Figure dubai-polices.ae-finesquery.com payload.Figure hyperfilevault1.xyz.Unit +22 more

Filename

mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe control.exe CMSTP.exe +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (5)

M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Exploitation (16)

M1013 Application Developer Guidance M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +11 more

Installation (20)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more

Command & Control (12)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +7 more

Actions on Objectives (18)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +13 more

Detection Coverage

73 strategies

6/7 stages covered

Reconnaissance (2)

DET0826 Detection of Gather Victim Host Informat... DET0869 Detection of Gather Victim Network Infor...

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (13)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... DET0330 Detection Strategy for T1546.016 - Event... +8 more

Installation (22)

DET0068 Detection Strategy for T1505.004 - Malic... DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0121 Detection Strategy for T1547.015 – Login... DET0144 Detect Forged Kerberos Golden Tickets (T... +17 more

Command & Control (12)

DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... DET0268 Detect Archiving via Library (T1560.002) +7 more

Actions on Objectives (23)

DET0042 Detection Strategy for T1218.012 Verclsi... DET0046 Detection Strategy for T1497 Virtualizat... DET0099 Detection Strategy for T1542.001 Pre-OS... DET0109 Detection Strategy for Plist File Modifi... DET0136 Behavior-chain detection for T1134.005 A... +18 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

DieNet

Type: Unknown Active

Shiite_Harvest MuddyWater tracked as Cyber Av3ngers Storm-0784 +4 more

Infrastructure 30 IOC(s)

50%

Domain

submit.php Vim.org iranforward.org donations.Figure emiratescryptobank.com.Figure +25

Artifacts (10)

mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe +4

Capability

50%

74 technique(s) 53 tool(s)/malware 1 CVE(s)

BITS CL-STA-1128 ClickOnce Cobalt Custom malware Cyber Av3ngers Dark Dark Storm Team +45

T0835

collection

T1123 T1125 T1560 T1560.001 +2

command and control

T1132.001 T1132.002

credential access

T1528 T1558 T1558.001 T1558.002 +2

Victim

70%

Targeted Sectors

financial-services government critical-infrastructure education telecommunications defense energy healthcare manufacturing media retail aviation non-profit transportation maritime

Targeted Countries

IL IR US AU AE TR SA EG RU IN NG PL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590 T1592

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org

4 Exploitation

Capability (Techniques)

T1059.013 T1129 T1559 T1559.001 T1559.002

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org

5 Installation

Capability (Techniques)

T1528 T1558 T1558.001 T1558.002 T1558.004

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org

6 Command & Control

Capability (Techniques)

T1123 T1125 T1560 T1560.001 T1560.002

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org

7 Actions on Objectives

Capability (Techniques)

T1490 T1498

Capability (Malware)

BITS CL-STA-1128 ClickOnce

Infrastructure

submit.php Vim.org iranforward.org