Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SideCopy (threat actor)

Risk

High

16 techniques 2 tools/malware 0 vulnerabilities 0 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1598.002

Spearphishing Attachment reconnaissance

›

2 Weaponization

T1584.001

Domains resource development

T1608.001

Upload Malware resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.005

Visual Basic execution

T1106

Native API execution

T1204.002

Malicious File execution

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1082

System Information Discovery discovery

T1518

Software Discovery discovery

T1518.001

Security Software Discovery discovery

T1614

System Location Discovery discovery

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

T1218.005

Mshta stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

Action RAT AuTo Stealer

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1017 User Training M1054 Software Configuration

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1021 Restrict Web-Based Content M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +1 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (8)

M1013 Application Developer Guidance M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1044 Restrict Library Loading +3 more

Detection Coverage

16 strategies

7/7 stages covered

Reconnaissance (1)

DET0865 Detection of Spearphishing Attachment

Weaponization (2)

DET0824 Detection of Upload Malware DET0863 Detection of Domains

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0076 Behavioral Detection of Visual Basic Exe... DET0294 User Execution – Malicious File via down... DET0529 Behavioral Detection of Native API Invoc...

Installation (5)

DET0016 Security Software Discovery Across Platf... DET0043 Detection Strategy for System Location D... DET0195 Behavioral Detection of System Network C... DET0392 Multi-Platform Software Discovery Behavi... DET0525 System Discovery via Native and Remote U...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (3)

DET0201 Detection Strategy for Hijack Execution... DET0347 Detection Strategy for Masquerading via... DET0506 Detecting Mshta-based Proxy Execution vi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

SideCopy

Type: Unknown Active

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

16 technique(s) 2 tool(s)/malware

Action RAT AuTo Stealer

command and control

T1105

discovery

T1016 T1082 T1518 T1518.001 +1

execution

T1059.005 T1106 T1204.002

initial access

T1566.001

Victim

70%

Targeted Sectors

government financial-services

Targeted Countries

Afghanistan

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1598.002

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1584.001 T1608.001

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.005 T1106 T1204.002

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1016 T1082 T1518 T1518.001 T1614

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Action RAT AuTo Stealer

Infrastructure

No infra linked