Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6040 (threat actor)

Risk

Critical

25 techniques 34 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1593

Search Open Websites/Domains reconnaissance

T1598

Phishing for Information reconnaissance

›

2 Weaponization

T1585

Establish Accounts resource development

T1586

Compromise Accounts resource development

T1587

Develop Capabilities resource development

T1588

Obtain Capabilities resource development

T1608

Stage Capabilities resource development

T1608.005

Link Target resource development

›

3 Delivery

T1566

Phishing initial access

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1204

User Execution execution

›

5 Installation

T1069

Permission Groups Discovery discovery

T1083

File and Directory Discovery discovery

T1136

Create Account persistence

T1671

Cloud Application Integration persistence

›

6 Command & Control

T1213

Data from Information Repositories collection

T1090

Proxy command and control

›

7 Actions on Objectives

T1020

Automated Exfiltration exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1036

Masquerading stealth

T1078

Valid Accounts stealth

T1078.002

Domain Accounts stealth

T1684

Social Engineering stealth

T1684.001

Impersonation stealth

Stage risk: Critical High Medium None

Tools & Malware (34)

8Base CALENDAR Chaos Custom Python script Custom scripts Dark Expand GitHub Global Leverage Malwarebytes Mullvad VPN service Okta phishing panel Open-source tools PHOTO Persistence mechanisms Phishing infrastructure PowerShell Python scripts Raccoon Ransomware variants Rover SHINYSP1D3R STOP SUNBURST Salesforce Data Loader (modified) SentinelOne Social engineering tactics SolarWinds StrelaStealer Tor browser TruffleHog Unknown phishing

Indicators of Compromise (40)

Domain

http.principal.user.userid FalconFeeds.io http.metadata http.target.url vnd.openxmlformats-officedocument.spreadsheetml.sheet Dave.com strings.concat e.principal.user.userid +29 more

Email Address

shinygroup@tuta.com shinycorp@tuta.com

Filename

enterprise-attack-v18.1-campaigns.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (4)

M1013 Application Developer Guidance M1017 User Training M1047 Audit M1054 Software Configuration

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Exploitation (11)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Installation (6)

M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication M1042 Disable or Remove Feature or Program +1 more

Command & Control (10)

M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +5 more

Actions on Objectives (17)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +12 more

Detection Coverage

25 strategies

7/7 stages covered

Reconnaissance (2)

DET0823 Detection of Phishing for Information DET0856 Detection of Search Open Websites/Domain...

Weaponization (6)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts +1 more

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (2)

DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (4)

DET0179 Behavioral Detection of Permission Group... DET0370 Recursive Enumeration of Files and Direc... DET0539 Detection Strategy for Cloud Application... DET0583 Detection Strategy for T1136 - Create Ac...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (7)

DET0127 Behavioral Detection of Masquerading Acr... DET0210 Abuse of Domain Accounts DET0286 Detection Strategy for Impersonation DET0397 Automated Exfiltration Detection Strateg... DET0548 Detection Strategy for Exfiltration Over... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6040

Type: Unknown Active

Cisco Chanel Air France tracked as also known as ShinyHunters +2 more

Infrastructure 37 IOC(s)

50%

Domain

http.principal.user.userid FalconFeeds.io http.metadata http.target.url vnd.openxmlformats-officedocument.spreadsheetml.sheet +32

Artifacts (3)

shinygroup@tuta.com shinycorp@tuta.com enterprise-attack-v18.1-campaigns.xlsx

Capability

50%

25 technique(s) 34 tool(s)/malware

8Base CALENDAR Chaos Custom Python script Custom scripts Dark Expand GitHub +26

collection

T1213

command and control

T1090

discovery

T1069 T1083

execution

T1059 T1204

Victim

70%

Targeted Sectors

financial-services government energy defense aviation healthcare maritime telecommunications education retail critical-infrastructure

Targeted Countries

FR GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1593 T1598

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

2 Weaponization

Capability (Techniques)

T1585 T1586 T1587 T1588 T1608

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

3 Delivery

Capability (Techniques)

T1566 T1566.004

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

4 Exploitation

Capability (Techniques)

T1059 T1204

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

5 Installation

Capability (Techniques)

T1069 T1083 T1136 T1671

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

6 Command & Control

Capability (Techniques)

T1213 T1090

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata

7 Actions on Objectives

Capability (Techniques)

T1020 T1567

Capability (Malware)

8Base CALENDAR Chaos

Infrastructure

http.principal.user.userid FalconFeeds.io http.metadata