Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAC-0245 (threat actor)

Risk

Critical

49 techniques 42 tools/malware 2 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1584

Compromise Infrastructure resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059.013

Container CLI/API execution

T1129

Shared Modules execution

T1559

Inter-Process Communication execution

T1559.001

Component Object Model execution

T1559.002

Dynamic Data Exchange execution

T1559.003

XPC Services execution

T1610

Deploy Container execution

T1548

Abuse Elevation Control Mechanism privilege escalation

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2025-22457

CVE CVE-2025-61882

›

5 Installation

T1558.004

AS-REP Roasting credential access

T1124

System Time Discovery discovery

T1135

Network Share Discovery discovery

T1518.002

Backup Software Discovery discovery

T1133

External Remote Services persistence

T1505

Server Software Component persistence

›

6 Command & Control

T1056

Input Capture collection

T1056.001

Keylogging collection

T1056.002

GUI Input Capture collection

T1056.003

Web Portal Capture collection

T1056.004

Credential API Hooking collection

T1123

Audio Capture collection

T1125

Video Capture collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1560.002

Archive via Library collection

T1560.003

Archive via Custom Method collection

T1102

Web Service command and control

T1132.001

Standard Encoding command and control

T1132.002

Non-Standard Encoding command and control

T1571

Non-Standard Port command and control

T1550

Use Alternate Authentication Material lateral movement

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1490

Inhibit System Recovery impact

T1498

Network Denial of Service impact

T1127

Trusted Developer Utilities Proxy Execution stealth

T1127.001

MSBuild stealth

T1127.002

ClickOnce stealth

T1127.003

JamPlus stealth

T1134

Access Token Manipulation stealth

T1134.001

Token Impersonation/Theft stealth

T1134.002

Create Process with Token stealth

T1134.003

Make and Impersonate Token stealth

T1134.004

Parent PID Spoofing stealth

T1134.005

SID-History Injection stealth

T1128

T1158

Stage risk: Critical High Medium None

Tools & Malware (42)

Agent Tesla BLINDINGCAN BOOKWORM BlackEnergy CABINETRAT CL0P Carbanak Cobalt Cobalt Strike CorKLOG Crimson DarkGate Global Group Policy Interception InvisibleFerret KONNI Keyloggers Kimsuky LODEINFO MacMa Machete Mispadu NETWIRE OilRig PAKLOG PlugX PowerShell PowerSploit QakBot ROKRAT Remcos Remexi Remsec SLOTHFULMEDIA STOP StarFish Trojan Warzone njRAT phishing systemd

Indicators of Compromise (40)

Domain

cisa.gov TEMP.Periscope macOS.OSAMiner Zeus.Variant.Panda OSX.CDDS W32.Duqu Reginfo.gov Salesforce.Salesforce +15 more

Filename

mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe control.exe w3wp.exe +9 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (15)

M1013 Application Developer Guidance M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Installation (14)

M1018 User Account Management M1021 Restrict Web-Based Content M1024 Restrict Registry Permissions M1026 Privileged Account Management M1027 Password Policies +9 more

Command & Control (12)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +7 more

Actions on Objectives (11)

M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1024 Restrict Registry Permissions M1026 Privileged Account Management +6 more

Detection Coverage

47 strategies

6/7 stages covered

Weaponization (1)

DET0885 Detection of Compromise Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (9)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... DET0335 Detect Abuse of XPC Services (T1559.003) +4 more

Installation (6)

DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0151 Behavior-chain, platform-aware detection... DET0182 Behavior-chain detection for T1135 Netwo... DET0354 Behavior-chain detection for T1133 Exter... +1 more

Command & Control (17)

DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0124 Behavior-chain detection for T1132.001 D... DET0139 Detection of Credential Harvesting via A... DET0185 Behavioral Detection Strategy for Use Al... +12 more

Actions on Objectives (13)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0280 Behavior-Based Registry Modification Det... DET0283 Behavior-chain detection for T1134 Acces... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAC-0245

Type: Unknown Active

tracked as techniki Advanced Persistent Threat 39 Chafer Cadelspy +5 more

Infrastructure 23 IOC(s)

50%

Domain

cisa.gov TEMP.Periscope macOS.OSAMiner Zeus.Variant.Panda OSX.CDDS +18

Artifacts (17)

mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe +11

Capability

50%

49 technique(s) 42 tool(s)/malware 2 CVE(s)

Agent Tesla BLINDINGCAN BOOKWORM BlackEnergy CABINETRAT CL0P Carbanak Cobalt +34

T1128 T1158

collection

T1056 T1056.001 T1056.002 T1056.003 +7

command and control

T1102 T1132.001 T1132.002 T1571

credential access

T1558.004

Victim

70%

Targeted Sectors

government defense non-profit financial-services media maritime energy nuclear manufacturing oil-gas education mining telecommunications think-tank

Targeted Countries

UA US IR MX IN VN KP KR BY AZ CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1584

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner

4 Exploitation

Capability (Techniques)

T1059.013 T1129 T1559 T1559.001 T1559.002

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner

5 Installation

Capability (Techniques)

T1558.004 T1124 T1135 T1518.002 T1133

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner

6 Command & Control

Capability (Techniques)

T1056 T1056.001 T1056.002 T1056.003 T1056.004

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner

7 Actions on Objectives

Capability (Techniques)

T1490 T1498

Capability (Malware)

Agent Tesla BLINDINGCAN BOOKWORM

Infrastructure

cisa.gov TEMP.Periscope macOS.OSAMiner