Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CL-STA-1087 (threat actor)

Risk

Critical

40 techniques 43 tools/malware 1 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.001

Credentials reconnaissance

T1589.002

Email Addresses reconnaissance

T1589.003

Employee Names reconnaissance

T1590.001

Domain Properties reconnaissance

T1590.002

DNS reconnaissance

T1591.001

Determine Physical Locations reconnaissance

T1591.002

Business Relationships reconnaissance

T1592.004

Client Configurations reconnaissance

T1595

Active Scanning reconnaissance

T1596.001

DNS/Passive DNS reconnaissance

T1596.003

Digital Certificates reconnaissance

T1596.004

CDNs reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.002

DNS Server resource development

T1583.005

Botnet resource development

T1584

Compromise Infrastructure resource development

T1584.001

Domains resource development

T1584.002

DNS Server resource development

T1584.005

Botnet resource development

T1585.002

Email Accounts resource development

T1586

Compromise Accounts resource development

T1586.002

Email Accounts resource development

T1587

Develop Capabilities resource development

T1587.002

Code Signing Certificates resource development

T1587.003

Digital Certificates resource development

T1588.003

Code Signing Certificates resource development

T1588.004

Digital Certificates resource development

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1204

User Execution execution

CVE CVE-2019-11580

›

5 Installation

T1557.002

ARP Cache Poisoning credential access

T1558.004

AS-REP Roasting credential access

T1087.002

Domain Account discovery

T1580

Cloud Infrastructure Discovery discovery

T1614.001

System Language Discovery discovery

›

6 Command & Control

T1213

Data from Information Repositories collection

T1602

Data from Configuration Repository collection

›

7 Actions on Objectives

T1600.002

Disable Crypto Hardware defense impairment

T1601.002

Downgrade System Image defense impairment

T1562.008

Stage risk: Critical High Medium None

Tools & Malware (43)

AWS CLI AppleChris BOOKWORM Backdoors C2 infrastructure Cobalt Cobalt Strike Custom backdoors Custom tools DNSpionage Dark Dead Drop Resolvers Expand GitHub Global Godzilla Leverage Malicious files Mimikatz Mimikatz variant Nexus OilRig PLAY Payload Payload Phishing campaigns PowerShell Remote access tools Rootkit SMB protocol STOP SYNful Knock Sofacy Trojan TruffleHog Turla Unknown VShell Web Shells WildFire phishing scanbox systemd

Indicators of Compromise (40)

Domain

working.Adversaries zamstats.me gouvn.me raw.githubusercontent.com changelog.json example.timer example.service activity.Monitor +18 more

Filename

spoolsv.exe GoogleUpdate.exe dllhost.exe swprv32.sys verclsid.exe muudatused.zip Board.zip DiaoYu.exe +6 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Exploitation (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +3 more

Installation (10)

M1017 User Training M1018 User Account Management M1027 Password Policies M1028 Operating System Configuration M1031 Network Intrusion Prevention +5 more

Command & Control (11)

M1017 User Training M1018 User Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +6 more

Actions on Objectives (6)

M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication M1043 Credential Access Protection M1045 Code Signing +1 more

Detection Coverage

39 strategies

6/7 stages covered

Reconnaissance (12)

DET0806 Detection of Determine Physical Location... DET0809 Detection of CDNs DET0813 Detection of Credentials DET0814 Detection of Email Addresses DET0820 Detection of Client Configurations +7 more

Weaponization (16)

DET0833 Detection of Code Signing Certificates DET0835 Detection of Email Accounts DET0837 Detection of Botnet DET0844 Detection of Digital Certificates DET0848 Detection of Digital Certificates +11 more

Exploitation (2)

DET0364 Behavioral Detection Strategy for WMI Ex... DET0478 User Execution – multi-surface behavior...

Installation (5)

DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0129 Domain Account Enumeration Across Platfo... DET0169 Detection Strategy for Cloud Infrastruct... DET0387 Detect ARP Cache Poisoning Across Linux,... DET0565 Detection Strategy for System Language D...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0592 Detection Strategy for Data from Configu...

Actions on Objectives (2)

DET0494 Detection Strategy for Weaken Encryption... DET0569 Detection Strategy for Downgrade System...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CL-STA-1087

Type: Unknown Active

tracked as UNC6619

Infrastructure 26 IOC(s)

50%

Domain

working.Adversaries zamstats.me gouvn.me raw.githubusercontent.com changelog.json +21

Artifacts (14)

spoolsv.exe GoogleUpdate.exe dllhost.exe swprv32.sys verclsid.exe muudatused.zip +8

Capability

50%

40 technique(s) 43 tool(s)/malware 1 CVE(s)

AWS CLI AppleChris BOOKWORM Backdoors C2 infrastructure Cobalt Cobalt Strike Custom backdoors +35

T1562.008

collection

T1213 T1602

credential access

T1557.002 T1558.004

defense impairment

T1600.002 T1601.002

Victim

70%

Targeted Sectors

defense government media critical-infrastructure mining financial-services telecommunications utilities energy aviation

Targeted Countries

CN US BR IN MX DE VN TW BY PL IT KR SA JP NG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.001 T1589.002 T1589.003 T1590.001 T1590.002

Capability (Malware)

AWS CLI AppleChris BOOKWORM

Infrastructure

working.Adversaries zamstats.me gouvn.me

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.002 T1583.005 T1584

Capability (Malware)

AWS CLI AppleChris BOOKWORM

Infrastructure

working.Adversaries zamstats.me gouvn.me

4 Exploitation

Capability (Techniques)

T1047 T1204

Capability (Malware)

AWS CLI AppleChris BOOKWORM

Infrastructure

working.Adversaries zamstats.me gouvn.me

5 Installation

Capability (Techniques)

T1557.002 T1558.004 T1087.002 T1580 T1614.001

Capability (Malware)

AWS CLI AppleChris BOOKWORM

Infrastructure

working.Adversaries zamstats.me gouvn.me

6 Command & Control

Capability (Techniques)

T1213 T1602

Capability (Malware)

AWS CLI AppleChris BOOKWORM

Infrastructure

working.Adversaries zamstats.me gouvn.me