Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

NyxarGroup (threat actor)

Risk

Medium

10 techniques 46 tools/malware 0 vulnerabilities 5 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1204.004

Malicious Copy and Paste execution

›

5 Installation

No data

›

6 Command & Control

T1114.003

Email Forwarding Rule collection

T1530

Data from Cloud Storage collection

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1078.004

Cloud Accounts stealth

T1564.008

Email Hiding Rules stealth

Stage risk: Critical High Medium None

Tools & Malware (46)

Agent Tesla AppDomainManager BITS Cobalt DCSync Dark Emotet Expand Group Policy Hook Interception KongTuke Leverage LummaC2 Lynx MSBuild Matrix MintsLoader Msiexec Netsupport Manager PlugX PowerShell Process Hollowing RedLine Stealer Remote access tools Rhadamanthys Rogue Rootkit Rundll32 STOP SUNBURST Sednit SentinelOne SocGholish Sofacy SolarWinds Trojan Web Shell Windows Command Shell curl inter malware distribution mshta netsh phishing systemd

Indicators of Compromise (5)

Domain

demo-cloud.space cisa.gov Mallory.ai M.Sc

Email Address

info@redcanary.com

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Command & Control (9)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +4 more

Actions on Objectives (10)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +5 more

Detection Coverage

10 strategies

3/7 stages covered

Exploitation (4)

DET0340 User Execution – Malicious Copy & Paste... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Command & Control (3)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0484 Multi-Platform Cloud Storage Exfiltratio... DET0576 Email Forwarding Rule Abuse Detection Ac...

Actions on Objectives (3)

DET0192 Detection Strategy for Email Hiding Rule... DET0378 Behavioral Detection of Obfuscated Files... DET0546 Detection of Abused or Compromised Cloud...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

NyxarGroup

Type: Unknown Active

tracked as APT28 Pawn Storm Fancy Bear Sednit

Infrastructure 4 IOC(s)

50%

Domain

demo-cloud.space cisa.gov Mallory.ai M.Sc

Artifacts (1)

info@redcanary.com

Capability

50%

10 technique(s) 46 tool(s)/malware

Agent Tesla AppDomainManager BITS Cobalt DCSync Dark Emotet Expand +38

collection

T1114.003 T1530

command and control

T1105

execution

T1047 T1059 T1059.001 T1204.004

stealth

T1027 T1078.004 T1564.008

Victim

70%

Targeted Sectors

defense financial-services manufacturing energy government aviation critical-infrastructure utilities

Targeted Countries

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1059 T1059.001 T1204.004

Capability (Malware)

Agent Tesla AppDomainManager BITS

Infrastructure

demo-cloud.space cisa.gov Mallory.ai

6 Command & Control

Capability (Techniques)

T1114.003 T1530 T1105

Capability (Malware)

Agent Tesla AppDomainManager BITS

Infrastructure

demo-cloud.space cisa.gov Mallory.ai