Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APTIran (threat actor)
Risk
85
Critical
48 techniques 55 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589
Gather Victim Identity Information reconnaissance
T1682
Query Public AI Services reconnaissance
›
2 Weaponization
5
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1585
Establish Accounts resource development
T1588
Obtain Capabilities resource development
T1608
Stage Capabilities resource development
›
3 Delivery
3
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
6
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1204
User Execution execution
›
5 Installation
10
T1003
OS Credential Dumping credential access
T1111
Multi-Factor Authentication Interception credential access
T1539
Steal Web Session Cookie credential access
T1555
Credentials from Password Stores credential access
T1016
System Network Configuration Discovery discovery
T1018
Remote System Discovery discovery
T1082
System Information Discovery discovery
T1087
Account Discovery discovery
T1518
Software Discovery discovery
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
11
T1056
Input Capture collection
T1113
Screen Capture collection
T1115
Clipboard Data collection
T1530
Data from Cloud Storage collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1102
Web Service command and control
T1132
Data Encoding command and control
T1573
Encrypted Channel command and control
›
7 Actions on Objectives
11
T1112
Modify Registry defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1070
Indicator Removal stealth
T1078
Valid Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1197
BITS Jobs stealth
T1497
Virtualization/Sandbox Evasion stealth
T1684
Social Engineering stealth
T1060
T1060
Stage risk: Critical High Medium None

Tools & Malware (55)

AnyDesk AppDomainManager AutoIt BLUETORCH Beacon ClickFix Cobalt Cobalt Strike Commodity ransomware loaders (ALPHV/LockBit) CrackMapExec Custom malware Custom tools Cybercrime RATs and loaders Epic Fooder GHAMBAR Global Google Drive Leverage Mimikatz MiniJunk MiniJunk V2 MiniUpdate MuddyWater NICECURL Nexus OilRig PLINK Payload Payload Phishing campaigns Phishing emails Phoenix PowerShell ProcDump Rana Remexi Remote Monitoring & Management utilities (e.g., AnyDesk, ScreenConnect) Scheduled Tasks ScreenConnect Setup.exe Signed vendor binaries used for malicious execution SmartFTP Password Decryptor Social engineering tactics Spear-phishing Telegram Telegram bot Trojan UNC1549 UPX Web Shells WildFire Windows Command Shell Windows Credential Editor (WCE) phishing

Indicators of Compromise (40)

Domain
docspace-twpf0e.onlyoffice.com 2117.filemail.com PremierHealthAdvisory.com PremierHealthAdvisory.azurewebsites.net Premier-HealthAdvisory.azurewebsites.net Ramiltonsfinance.com Ramiltons-finance.azurewebsites.net update.exe.config +14 more
Filename
JR205894.pdf platform.zip Unbcl.dll nvdaHelperRemote.dll Portal.zip UpdateChecker.dll uevmonitor.dll InitInstall.dll +9 more
MD5 Hash
edcdba624ddb43c2a1dcf334aa493068

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (14)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more
Installation (15)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity +10 more
Command & Control (9)
M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention +4 more
Actions on Objectives (21)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +16 more

Detection Coverage

47 strategies
7/7 stages covered

Reconnaissance (2)

DET0841 Detection of Gather Victim Identity Info... DET0919 Detection of Query Public AI Services

Weaponization (5)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0873 Detection of Establish Accounts DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (6)

DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +1 more

Installation (10)

DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... DET0246 Detection Strategy for MFA Interception... DET0274 Boot or Logon Autostart Execution Detect... DET0392 Multi-Platform Software Discovery Behavi... +5 more

Command & Control (11)

DET0027 Detection of Web Protocol-Based C2 Over... DET0102 Behavioral Detection of Input Capture Ac... DET0108 Detection Strategy for Data Encoding in... DET0273 Detection Strategy for Encrypted Channel... DET0341 Clipboard Data Access with Anomalous Con... +6 more

Actions on Objectives (10)

DET0046 Detection Strategy for T1497 Virtualizat... DET0098 Detect abuse of Windows BITS Jobs for do... DET0127 Behavioral Detection of Masquerading Acr... DET0184 Behavioral Detection of Indicator Remova... DET0275 Detect Adversary Deobfuscation or Decodi... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

APTIran

Type: Unknown Active
Chafer APT39 OilRig Helix Kitten MuddyWater +20 more
Infrastructure 22 IOC(s)
50%
Domain
docspace-twpf0e.onlyoffice.com 2117.filemail.com PremierHealthAdvisory.com PremierHealthAdvisory.azurewebsites.net Premier-HealthAdvisory.azurewebsites.net +17
Artifacts (18)
JR205894.pdf platform.zip Unbcl.dll nvdaHelperRemote.dll Portal.zip UpdateChecker.dll +12
Capability
50%
48 technique(s) 55 tool(s)/malware
AnyDesk AppDomainManager AutoIt BLUETORCH Beacon ClickFix Cobalt Cobalt Strike +47
T1060
collection
T1056 T1113 T1115 T1530 +1
command and control
T1071 T1071.001 T1090 T1102 +2
credential access
T1003 T1111 T1539 T1555
Victim
70%

Targeted Sectors

government defense telecommunications financial-services aerospace critical-infrastructure healthcare transportation energy manufacturing education hospitality oil-gas utilities

Targeted Countries

IR AE IL US CN SA PK BY IQ SY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1682

Capability (Malware)

AnyDesk AppDomainManager AutoIt
2 Weaponization

Capability (Malware)

AnyDesk AppDomainManager AutoIt
3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

AnyDesk AppDomainManager AutoIt
4 Exploitation

Capability (Malware)

AnyDesk AppDomainManager AutoIt
5 Installation

Capability (Malware)

AnyDesk AppDomainManager AutoIt
6 Command & Control

Capability (Malware)

AnyDesk AppDomainManager AutoIt
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AnyDesk AppDomainManager AutoIt
Leaving Threaticon

This link opens an external site that isn't part of the platform.