Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-1977 (threat actor)

Risk

High

40 techniques 44 tools/malware 0 vulnerabilities 15 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059.013

Container CLI/API execution

T1129

Shared Modules execution

T1559

Inter-Process Communication execution

T1559.001

Component Object Model execution

T1559.002

Dynamic Data Exchange execution

T1559.003

XPC Services execution

T1610

Deploy Container execution

T1548

Abuse Elevation Control Mechanism privilege escalation

›

5 Installation

T1558

Steal or Forge Kerberos Tickets credential access

T1558.001

Golden Ticket credential access

T1558.002

Silver Ticket credential access

T1558.003

Kerberoasting credential access

T1558.004

AS-REP Roasting credential access

T1558.005

Ccache Files credential access

T1124

System Time Discovery discovery

T1135

Network Share Discovery discovery

T1518.002

Backup Software Discovery discovery

T1133

External Remote Services persistence

›

6 Command & Control

T1123

Audio Capture collection

T1125

Video Capture collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1560.002

Archive via Library collection

T1560.003

Archive via Custom Method collection

T1132.001

Standard Encoding command and control

T1132.002

Non-Standard Encoding command and control

T1550

Use Alternate Authentication Material lateral movement

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1490

Inhibit System Recovery impact

T1498

Network Denial of Service impact

T1127

Trusted Developer Utilities Proxy Execution stealth

T1127.001

MSBuild stealth

T1127.002

ClickOnce stealth

T1127.003

JamPlus stealth

T1134

Access Token Manipulation stealth

T1134.001

Token Impersonation/Theft stealth

T1134.002

Create Process with Token stealth

T1134.003

Make and Impersonate Token stealth

T1134.004

Parent PID Spoofing stealth

T1134.005

SID-History Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (44)

AzureChecker.exe BITS CALENDAR Chameleon DCSync Emissary GitHub Global Group Policy Hook Imperial Kitten Interception Jackal KONNI Kimsuky Labyrinth Chollima LockBit MSBuild Medusa Msiexec MuddyWater Payload Payload PowerShell Process Hollowing REvil Remote access tools Rogue Rootkit Rundll32 STOP SUNBURST SolarWinds Tsunami Unknown Web Shell Wicked Windows Command Shell inter lockscreen mshta netsh phishing systemd

Indicators of Compromise (15)

Domain

TEMP.Zagros TEMP.Periscope NTDS.dit macOS.OSAMiner tidal-campaigns.json tcpdump101.com

Filename

PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe control.exe CMSTP.exe hh.exe mavinject.exe +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (15)

M1013 Application Developer Guidance M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Installation (12)

M1015 Active Directory Configuration M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +7 more

Command & Control (10)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +5 more

Actions on Objectives (10)

M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +5 more

Detection Coverage

40 strategies

4/7 stages covered

Exploitation (8)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... DET0335 Detect Abuse of XPC Services (T1559.003) +3 more

Installation (10)

DET0024 Detect Kerberos Ccache File Theft or Abu... DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0144 Detect Forged Kerberos Golden Tickets (T... DET0151 Behavior-chain, platform-aware detection... +5 more

Command & Control (10)

DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... DET0268 Detect Archiving via Library (T1560.002) +5 more

Actions on Objectives (12)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0283 Behavior-chain detection for T1134 Acces... DET0329 Behavioral Detection for T1490 - Inhibit... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-1977

Type: Unknown Active

tracked as

Infrastructure 6 IOC(s)

50%

Domain

TEMP.Zagros TEMP.Periscope NTDS.dit macOS.OSAMiner tidal-campaigns.json +1

Artifacts (9)

PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe control.exe CMSTP.exe +3

Capability

50%

40 technique(s) 44 tool(s)/malware

AzureChecker.exe BITS CALENDAR Chameleon DCSync Emissary GitHub Global +36

collection

T1123 T1125 T1560 T1560.001 +2

command and control

T1132.001 T1132.002

credential access

T1558 T1558.001 T1558.002 T1558.003 +2

discovery

T1124 T1135 T1518.002

Victim

70%

Targeted Sectors

education financial-services non-profit defense mining energy government think-tank media

Targeted Countries

IL IT RU KP IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059.013 T1129 T1559 T1559.001 T1559.002

Capability (Malware)

AzureChecker.exe BITS CALENDAR

Infrastructure

TEMP.Zagros TEMP.Periscope NTDS.dit

5 Installation

Capability (Techniques)

T1558 T1558.001 T1558.002 T1558.003 T1558.004

Capability (Malware)

AzureChecker.exe BITS CALENDAR

Infrastructure

TEMP.Zagros TEMP.Periscope NTDS.dit

6 Command & Control

Capability (Techniques)

T1123 T1125 T1560 T1560.001 T1560.002

Capability (Malware)

AzureChecker.exe BITS CALENDAR

Infrastructure

TEMP.Zagros TEMP.Periscope NTDS.dit

7 Actions on Objectives

Capability (Techniques)

T1490 T1498

Capability (Malware)

AzureChecker.exe BITS CALENDAR

Infrastructure

TEMP.Zagros TEMP.Periscope NTDS.dit