Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC6395 (threat actor)
Risk
89
Critical
26 techniques 37 tools/malware 3 vulnerabilities 8 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1595.003
Wordlist Scanning reconnaissance
T1598
Phishing for Information reconnaissance
›
2 Weaponization
8
T1585
Establish Accounts resource development
T1586
Compromise Accounts resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.005
Link Target resource development
›
3 Delivery
1
T1189
Drive-by Compromise initial access
›
4 Exploitation
4
T1059
Command and Scripting Interpreter execution
CVE CVE-2025-43300
CVE CVE-2025-53690
CVE CVE-2025-55177
›
5 Installation
2
T1083
File and Directory Discovery discovery
T1671
Cloud Application Integration persistence
›
6 Command & Control
2
T1213
Data from Information Repositories collection
T1090
Proxy command and control
›
7 Actions on Objectives
10
T1112
Modify Registry defense impairment
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1036
Masquerading stealth
T1078
Valid Accounts stealth
T1078.001
Default Accounts stealth
T1078.002
Domain Accounts stealth
T1684
Social Engineering stealth
T1684.001
Impersonation stealth
Stage risk: Critical High Medium None

Tools & Malware (37)

AdWind AuraInspector CALENDAR Chaos Dark Data Loader Expand GitHub Global Hexstrike‑AI Icarus Leverage Malwarebytes Mullvad VPN Okta phishing panel Open-source tools Persistence mechanisms PowerShell Python script Python scripts Rogue Rover Royal SHINYSP1D3R STOP SUNBURST Salesloft Drift Salesloft Drift Integration SentinelOne SolarWinds Telegram Tor TruffleHog Unknown WhatsApp and many others phishing

Indicators of Compromise (8)

Domain
Chess.com vnd.openxmlformats-officedocument.spreadsheetml.sheet NetSecurity.com Dave.com Mallory.ai
Email Address
shinycorp@tuta.com shinygroup@tuta.com
Filename
enterprise-attack-v18.1-campaigns.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (4)
M1017 User Training M1042 Disable or Remove Feature or Program M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (5)
M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Installation (2)
M1042 Disable or Remove Feature or Program M1047 Audit
Command & Control (10)
M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +5 more
Actions on Objectives (19)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +14 more

Detection Coverage

26 strategies
7/7 stages covered

Reconnaissance (2)

DET0823 Detection of Phishing for Information DET0868 Detection of Wordlist Scanning

Weaponization (8)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0853 Detection of Develop Capabilities DET0872 Detection of Malware +3 more

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0370 Recursive Enumeration of Files and Direc... DET0539 Detection Strategy for Cloud Application...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (10)

DET0127 Behavioral Detection of Masquerading Acr... DET0210 Abuse of Domain Accounts DET0280 Behavior-Based Registry Modification Det... DET0286 Detection Strategy for Impersonation DET0348 Detection Strategy for Exfiltration Over... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC6395

Type: Unknown Active
tracked as UNC6040 UNC6240
Infrastructure 5 IOC(s)
50%
Domain
Chess.com vnd.openxmlformats-officedocument.spreadsheetml.sheet NetSecurity.com Dave.com Mallory.ai
Artifacts (3)
shinycorp@tuta.com shinygroup@tuta.com enterprise-attack-v18.1-campaigns.xlsx
Capability
50%
26 technique(s) 37 tool(s)/malware 3 CVE(s)
AdWind AuraInspector CALENDAR Chaos Dark Data Loader Expand GitHub +29
collection
T1213
command and control
T1090
defense impairment
T1112
discovery
T1083
Victim
70%

Targeted Sectors

financial-services telecommunications education retail critical-infrastructure defense government manufacturing gaming healthcare transportation

Targeted Countries

GB RU CN VN BR US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.003 T1598

Capability (Malware)

AdWind AuraInspector CALENDAR
2 Weaponization

Capability (Malware)

AdWind AuraInspector CALENDAR
3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

AdWind AuraInspector CALENDAR
4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

AdWind AuraInspector CALENDAR
5 Installation

Capability (Techniques)

T1083 T1671

Capability (Malware)

AdWind AuraInspector CALENDAR
6 Command & Control

Capability (Techniques)

T1213 T1090

Capability (Malware)

AdWind AuraInspector CALENDAR
7 Actions on Objectives

Capability (Techniques)

T1020 T1041 T1567

Capability (Malware)

AdWind AuraInspector CALENDAR
Leaving Threaticon

This link opens an external site that isn't part of the platform.