Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT1 (threat actor)

Risk

High

23 techniques 7 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1584.001

Domains resource development

T1585.002

Email Accounts resource development

T1588.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

›

5 Installation

T1003.001

LSASS Memory credential access

T1007

System Service Discovery discovery

T1016

System Network Configuration Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1087.001

Local Account discovery

T1135

Network Share Discovery discovery

›

6 Command & Control

T1005

Data from Local System collection

T1114.001

Local Email Collection collection

T1114.002

Remote Email Collection collection

T1119

Automated Collection collection

T1560.001

Archive via Utility collection

T1021.001

Remote Desktop Protocol lateral movement

T1550.002

Pass the Hash lateral movement

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

Stage risk: Critical High Medium None

Tools & Malware (7)

BISCUIT CALENDAR GLOOXMAIL PoisonIvy Seasalt WEBC2 and many others

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (1)

M1038 Execution Prevention

Installation (7)

M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +2 more

Command & Control (14)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1029 Remote Data Storage M1030 Network Segmentation +9 more

Actions on Objectives (3)

M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing

Detection Coverage

23 strategies

6/7 stages covered

Weaponization (5)

DET0835 Detection of Email Accounts DET0845 Detection of Malware DET0852 Detection of Tool DET0863 Detection of Domains DET0892 Detection of Domains

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (7)

DET0034 Detection of Adversarial Process Discove... DET0182 Behavior-chain detection for T1135 Netwo... DET0195 Behavioral Detection of System Network C... DET0303 Local Account Enumeration Across Host Pl... DET0320 Detection of System Network Connections... +2 more

Command & Control (7)

DET0047 Detect Local Email Collection via Outloo... DET0048 Detect Remote Email Collection via Abnor... DET0186 Automated File and API Collection Detect... DET0298 Detect Archiving via Utility (T1560.001) DET0327 Multi-event Detection Strategy for RDP-B... +2 more

Actions on Objectives (1)

DET0347 Detection Strategy for Masquerading via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

APT1

Type: Unknown Active

Comment Crew Comment Group Comment Panda PLA Unit 61398 TG-8223 +9 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

23 technique(s) 7 tool(s)/malware

BISCUIT CALENDAR GLOOXMAIL PoisonIvy Seasalt WEBC2 and many others

collection

T1005 T1114.001 T1114.002 T1119 +1

credential access

T1003.001

discovery

T1007 T1016 T1049 T1057 +2

execution

T1059.003

Victim

70%

Targeted Sectors

government

Targeted Countries

US CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1584.001 T1585.002 T1588.001 T1588.002

Capability (Malware)

BISCUIT CALENDAR GLOOXMAIL

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

BISCUIT CALENDAR GLOOXMAIL

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

BISCUIT CALENDAR GLOOXMAIL

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1003.001 T1007 T1016 T1049 T1057

Capability (Malware)

BISCUIT CALENDAR GLOOXMAIL

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1005 T1114.001 T1114.002 T1119 T1560.001

Capability (Malware)

BISCUIT CALENDAR GLOOXMAIL

Infrastructure

No infra linked