Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
BladedFeline (threat actor)
Risk
85
Critical
32 techniques 52 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1586.002
Email Accounts resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
7
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.006
Python execution
T1059.007
JavaScript execution
T1559
Inter-Process Communication execution
T1569.002
Service Execution execution
T1546
Event Triggered Execution privilege escalation
›
5 Installation
3
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
7
T1071.001
Web Protocols command and control
T1071.003
Mail Protocols command and control
T1090
Proxy command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1573.001
Symmetric Cryptography command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
9
T1041
Exfiltration Over C2 Channel exfiltration
T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol exfiltration
T1499.004
Application or System Exploitation impact
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078
Valid Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1077
T1077
T1086
T1086
Stage risk: Critical High Medium None

Tools & Malware (52)

Amadey Backdoors Beacon BlueSky C2 infrastructure ClickFix Crisis Custom Backdoor Custom Plink Custom malware DanaBot Dark Expand Explorer Flog Global Hawking Hawking Listener Infostealer LIGHTRAIL Laret MINIBIKE MINIBUS Nexus Nimbus Manticore OilRig P.S. Olala Payload Payload Pinar PowerShell PrimeCache PsExec RDAT RDAT Backdoor RedLine Schlippery Snakelet Shahmaran Shahmaran backdoor Sheep Tunneler Snake Spear-phishing StealC infostealer Stealc SysInternals UNC1549 Unknown VideoSRV Void Whisper curl phishing

Indicators of Compromise (40)

Domain
ilengineeringrssfeed.azurewebsites.net favicon.ico Screenshot.img tnlsowkis.westus3.cloudapp.azure.com client.pdb careers-finder.com tnlsowki.westus3.cloudapp.azure.com turkairline.azurewebsites.net +13 more
Filename
lastenzug.dll cmd.exe secur32.dll FileCoAuth.exe Protocol.pdf.exe wincapsrv.exe Mini-Junked.dll Micro.dll +6 more
MD5 Hash
4a223bc9c6096ac6bae3e7452ed6a1cd ec6a0434b94f51aa1df76a066aa05413
SHA-1 Hash
BE0AD25B7B48347984908175404996531CFD74B7 562E1678EC8FDC1D83A3F73EB511A6DDA08F3B3D
IPv4 Address
111.0.0.2

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (14)
M1013 Application Developer Guidance M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1033 Limit Software Installation +9 more
Installation (9)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more
Command & Control (3)
M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +7 more

Detection Coverage

30 strategies
7/7 stages covered

Reconnaissance (1)

DET0867 Detection of Vulnerability Scanning

Weaponization (4)

DET0838 Detection of Virtual Private Server DET0861 Detection of Email Accounts DET0892 Detection of Domains DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (7)

DET0010 Behavioral Detection of Event Triggered... DET0063 Cross-Platform Behavioral Detection of P... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0421 Detection Strategy for System Services S... +2 more

Installation (3)

DET0234 Credential Dumping via Sensitive Memory... DET0363 Detection of Credential Dumping from LSA... DET0365 Detect Registry and Startup Folder Persi...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0143 Detection Strategy for Encrypted Channel... +2 more

Actions on Objectives (7)

DET0140 Behavioral Detection of Malicious File D... DET0275 Detect Adversary Deobfuscation or Decodi... DET0304 Detection Strategy for Endpoint DoS via... DET0348 Detection Strategy for Exfiltration Over... DET0503 Behavioral Detection Strategy for Exfilt... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

BladedFeline

Type: Unknown Active
HEXANE Storm-0133 as another OilRig subgroup tracked as APT34
Infrastructure 22 IOC(s)
50%
Domain
ilengineeringrssfeed.azurewebsites.net favicon.ico Screenshot.img tnlsowkis.westus3.cloudapp.azure.com client.pdb +16
IPv4 Address
111.0.0.2
Artifacts (18)
lastenzug.dll cmd.exe secur32.dll FileCoAuth.exe Protocol.pdf.exe wincapsrv.exe +12
Capability
50%
32 technique(s) 52 tool(s)/malware
Amadey Backdoors Beacon BlueSky C2 infrastructure ClickFix Crisis Custom Backdoor +44
T1077 T1086
command and control
T1071.001 T1071.003 T1090 T1105 +3
credential access
T1003 T1003.001
execution
T1059.001 T1059.003 T1059.006 T1059.007 +2
Victim
70%

Targeted Sectors

government telecommunications defense aerospace aviation energy healthcare critical-infrastructure transportation financial-services chemical education

Targeted Countries

IR IL IQ AE IN US TR LB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002

Capability (Malware)

Amadey Backdoors Beacon
2 Weaponization

Capability (Malware)

Amadey Backdoors Beacon
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Amadey Backdoors Beacon
4 Exploitation

Capability (Malware)

Amadey Backdoors Beacon
5 Installation

Capability (Techniques)

T1003 T1003.001 T1547.001

Capability (Malware)

Amadey Backdoors Beacon
6 Command & Control

Capability (Malware)

Amadey Backdoors Beacon
7 Actions on Objectives

Capability (Techniques)

T1041 T1048.001 T1499.004

Capability (Malware)

Amadey Backdoors Beacon
Leaving Threaticon

This link opens an external site that isn't part of the platform.