Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Patched Lightning (threat actor)

Risk

Medium

1 techniques 44 tools/malware 2 vulnerabilities 18 IOCs 2/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1195

Supply Chain Compromise initial access

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2017-0005

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (44)

Agent Tesla Aurora BANSHEE BARIUM Buhtrap Carbon Citrine Sleet Cobalt Crimson Dark DarkHotel Emissary Ghost RAT GitHub Global Hafnium Imperial Kitten Jackal Kimsuky Labyrinth Chollima Luna Lynx Mango Matrix Mirage Moonstone Sleet Mythic Naikon OilRig Pink Poseidon SUNBURST Sednit Smoke Sandstorm Sofacy TeamSpy Tsunami Turla VICEROY Void Wicked Winnti gcman phishing

Indicators of Compromise (18)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +10 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

6 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1018 User Account Management M1033 Limit Software Installation M1046 Boot Integrity +1 more

Detection Coverage

1 strategies

1/7 stages covered

Delivery (1)

DET0537 Behavioral detection for Supply Chain Co...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Patched Lightning

Type: Unknown Active

Storm-0113 tracked as the Newscaster Team cpyy APT3 +19 more

Infrastructure 18 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +13

Capability

50%

1 technique(s) 44 tool(s)/malware 2 CVE(s)

Agent Tesla Aurora BANSHEE BARIUM Buhtrap Carbon Citrine Sleet Cobalt +36

initial access

T1195

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy media aerospace education think-tank information-technology maritime manufacturing pharmaceutical chemical mining healthcare legal-services gaming utilities hospitality nuclear entertainment

Targeted Countries

US CN IR IN RU GB IL JP DE KR SA TW KP TR FR CA VN AU KZ PK UA PL AE SG NL BR ES IQ BY IT SY MX RO LB EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1195

Capability (Malware)

Agent Tesla Aurora BANSHEE

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles