Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Sowbug (threat actor)

Risk

Medium

9 techniques 2 tools/malware 0 vulnerabilities 0 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059.003

Windows Command Shell execution

›

5 Installation

T1003

OS Credential Dumping credential access

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

›

6 Command & Control

T1039

Data from Network Shared Drive collection

T1056.001

Keylogging collection

T1560.001

Archive via Utility collection

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

Felismus Starloader

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (1)

M1038 Execution Prevention

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Command & Control (1)

M1047 Audit

Actions on Objectives (3)

M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing

Detection Coverage

9 strategies

4/7 stages covered

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (4)

DET0182 Behavior-chain detection for T1135 Netwo... DET0234 Credential Dumping via Sensitive Memory... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (3)

DET0089 Behavioral Detection of Keylogging Activ... DET0298 Detect Archiving via Utility (T1560.001) DET0410 Detection Strategy for Data from Network...

Actions on Objectives (1)

DET0347 Detection Strategy for Masquerading via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Sowbug

Type: Unknown Active

G0054

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

9 technique(s) 2 tool(s)/malware

Felismus Starloader

collection

T1039 T1056.001 T1560.001

credential access

T1003

discovery

T1082 T1083 T1135

execution

T1059.003

Victim

70%

Targeted Sectors

government

Targeted Countries

southeast_asia

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Felismus Starloader

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1003 T1082 T1083 T1135

Capability (Malware)

Felismus Starloader

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1039 T1056.001 T1560.001

Capability (Malware)

Felismus Starloader

Infrastructure

No infra linked