Kill Chain & Diamond Model Analysis
Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.
Scripted Sparrow
(threat actor)
9 techniques
45 tools/malware
26 vulnerabilities
13 IOCs
3/7 stages covered
Deepest: Actions on Objectives
›
›
›
›
›
›
7
Actions on Objectives
8
T1055 – Process Injection
T1059.003 – Command and Scripting Interpreter: PowerShell
T1071.004 – Application Layer Protocol: Web Traffic (HTTP/HTTPS) for C2
T1078.004 – Valid Accounts: Local Account (for mule accounts)
T1110.001 – Brute Force: Password Guessing
T1133 – External Remote Services
T1566.001 – Phishing: Spearphishing via Email
Stage risk:
Critical
High
Medium
None
Indicators of Compromise (13)
ATT&CK Tactic Coverage
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact
Recommended Mitigations
6 MITRE ATT&CK mitigations cover detected techniques
Browse all →
Detection Coverage
1 strategies
1/7 stages covered
Diamond Model of Intrusion
Adversary · Capability · Infrastructure · Victim
Scripted Sparrow
Type: Unknown Active
tracked as
the Newscaster Team
AquaTunnel
Chisel
AquaPurge
+3 more
9 technique(s) 45 tool(s)/malware 26 CVE(s)
Targeted Sectors
financial-services
government
media
telecommunications
defense
manufacturing
transportation
non-profit
critical-infrastructure
energy
Targeted Countries
RU
CN
UA
JP
US
PK
KP
Diamond Model Meta-Features
Phase
Actions on Objectives
Direction
Adversary → Infrastructure → Victim
Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Activity Threads
Kill chain phase → Diamond Model event mapping