Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-1747 (threat actor)

Risk

Critical

47 techniques 48 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

T1584

Compromise Infrastructure resource development

›

3 Delivery

T1566

Phishing initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.013

Container CLI/API execution

T1129

Shared Modules execution

T1559

Inter-Process Communication execution

T1559.001

Component Object Model execution

T1559.002

Dynamic Data Exchange execution

T1559.003

XPC Services execution

T1610

Deploy Container execution

›

5 Installation

T1003

OS Credential Dumping credential access

T1110

Brute Force credential access

T1110.001

Password Guessing credential access

T1558.001

Golden Ticket credential access

T1558.004

AS-REP Roasting credential access

T1124

System Time Discovery discovery

T1135

Network Share Discovery discovery

T1518.002

Backup Software Discovery discovery

T1133

External Remote Services persistence

›

6 Command & Control

T1056.004

Credential API Hooking collection

T1123

Audio Capture collection

T1125

Video Capture collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1560.002

Archive via Library collection

T1560.003

Archive via Custom Method collection

T1132.001

Standard Encoding command and control

T1132.002

Non-Standard Encoding command and control

T1571

Non-Standard Port command and control

T1550

Use Alternate Authentication Material lateral movement

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1490

Inhibit System Recovery impact

T1498

Network Denial of Service impact

T1055

Process Injection stealth

T1127

Trusted Developer Utilities Proxy Execution stealth

T1127.001

MSBuild stealth

T1127.002

ClickOnce stealth

T1127.003

JamPlus stealth

T1134

Access Token Manipulation stealth

T1134.001

Token Impersonation/Theft stealth

T1134.002

Create Process with Token stealth

T1134.003

Make and Impersonate Token stealth

T1134.004

Parent PID Spoofing stealth

T1134.005

SID-History Injection stealth

T1542

Pre-OS Boot stealth

Stage risk: Critical High Medium None

Tools & Malware (48)

AiTM Phishing Kit BARIUM BITS CALENDAR ClickFix Custom CAPTCHA Engine Device code phishing Empire Entropy Global Google Workspace Phishing Module Group Policy Hook Imperial Kitten Interception Labyrinth Chollima Leverage Medusa Microsoft Defender XDR Microsoft Teams Microsoft 365 Phishing Module MuddyWater Payload Payload Phishing Kit Phishing campaigns Phishing emails Phishing infrastructure Phishing kits Phishing-as-a-Service (PhaaS) platforms PowerShell Rogue Rootkit Rundll32 STOP Session Cookie Exfiltration Scripts SolarWinds Telegram Telegram Bot C&C Tsunami Tycoon Tycoon 2FA Phishing Kit Tycoon 2FA Kit Unknown Winnti macOS ClickFix phishing systemd

Indicators of Compromise (40)

Domain

emailsectionelecheck.querySelector cisa.gov ANY.RUN NTDS.dit macOS.OSAMiner vnd.openxmlformats-officedocument.spreadsheetml.sheet tcpdump101.com enterpriseregistration.windows.net +10 more

Email Address

victim@email.corp

Filename

enterprise-attack-v18.1-campaigns.xlsx Node.js mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs sdbinst.exe spoolsv.exe InstallUtil.exe +3 more

URL

http://astro.thorousha.ru/vojd4e50fw4o!g/$ENCODED http://branch.cricomai.sa.com/b@GrBOPttIrJA/*EMAIL_ADDRESS http://mysql.vecedoo.online/JB5ow79@fKst02/#EMAIL_ADDRESS http://backend.vmfuiojitnlb.es/CGyP9!CbhSU22YT2/ http://q9y3.efwzxgd.es/MEaap8nZG5A@c8T/*EMAIL_ADDRESS http://mock.zuyistoo.today/pry1r75TisN5S@8yDDQI/$EMAIL_ADDRESS http://qonnfp.wnrathttb.ru/Fe2yiyoKvg3YTfV!/$EMAIL_ADDRESS http://piwf.ariitdc.es/kv2gVMHLZ@dNeXt/$EMAIL_ADDRESS +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1017 User Training M1054 Software Configuration

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (13)

M1013 Application Developer Guidance M1018 User Account Management M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network +8 more

Installation (18)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity +13 more

Command & Control (11)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +6 more

Actions on Objectives (15)

M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Detection Coverage

47 strategies

7/7 stages covered

Reconnaissance (1)

DET0878 Detection of Spearphishing Link

Weaponization (1)

DET0885 Detection of Compromise Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (8)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... DET0335 Detect Abuse of XPC Services (T1559.003) +3 more

Installation (9)

DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0144 Detect Forged Kerberos Golden Tickets (T... DET0151 Behavior-chain, platform-aware detection... DET0182 Behavior-chain detection for T1135 Netwo... +4 more

Command & Control (12)

DET0124 Behavior-chain detection for T1132.001 D... DET0139 Detection of Credential Harvesting via A... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... +7 more

Actions on Objectives (14)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0278 Detection Strategy for T1542 Pre-OS Boot DET0283 Behavior-chain detection for T1134 Acces... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-1747

Type: Unknown Active

tracked as

Infrastructure 28 IOC(s)

50%

Domain

emailsectionelecheck.querySelector cisa.gov ANY.RUN NTDS.dit macOS.OSAMiner +13

URL

Artifacts (12)

victim@email.corp enterprise-attack-v18.1-campaigns.xlsx Node.js mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs +6

Capability

50%

47 technique(s) 48 tool(s)/malware

AiTM Phishing Kit BARIUM BITS CALENDAR ClickFix Custom CAPTCHA Engine Device code phishing Empire +40

collection

T1056.004 T1123 T1125 T1560 +3

command and control

T1132.001 T1132.002 T1571

credential access

T1003 T1110 T1110.001 T1558.001 +1

discovery

T1124 T1135 T1518.002

Victim

70%

Targeted Sectors

financial-services government defense non-profit healthcare education think-tank media construction

Targeted Countries

US IL RU KP IN DE FR ES CA GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1598.003

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

2 Weaponization

Capability (Techniques)

T1584

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

3 Delivery

Capability (Techniques)

T1566 T1566.002

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

4 Exploitation

Capability (Techniques)

T1059.001 T1059.013 T1129 T1559 T1559.001

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

5 Installation

Capability (Techniques)

T1003 T1110 T1110.001 T1558.001 T1558.004

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

6 Command & Control

Capability (Techniques)

T1056.004 T1123 T1125 T1560 T1560.001

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN

7 Actions on Objectives

Capability (Techniques)

T1490 T1498

Capability (Malware)

AiTM Phishing Kit BARIUM BITS

Infrastructure

emailsectionelecheck.querySelector cisa.gov ANY.RUN