Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
screening serpens (threat actor)
Risk
79
Critical
40 techniques 45 tools/malware 1 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
6
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.003
Windows Command Shell execution
T1129
Shared Modules execution
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2026-5817
›
5 Installation
11
T1012
Query Registry discovery
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1135
Network Share Discovery discovery
T1518
Software Discovery discovery
T1518.001
Security Software Discovery discovery
T1614
System Location Discovery discovery
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
4
T1115
Clipboard Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1219
Remote Access Tools command and control
›
7 Actions on Objectives
17
T1222
File and Directory Permissions Modification defense impairment
T1553.002
Code Signing defense impairment
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1027
Obfuscated Files or Information stealth
T1027.002
Software Packing stealth
T1036
Masquerading stealth
T1070
Indicator Removal stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1202
Indirect Command Execution stealth
T1497.001
System Checks stealth
T1564
Hide Artifacts stealth
T1564.003
Hidden Window stealth
T1574.001
DLL stealth
T1574.014
AppDomainManager stealth
T1622
Debugger Evasion stealth
Stage risk: Critical High Medium None

Tools & Malware (45)

AppDomainManager Backdoors CALENDAR CLAIMLOADER ClickFix Crimson Custom tools Dark Expand Firefox Gentlemen Global HIUPAN Handala Karma Leverage MASOL MiniFast MiniJunk MiniJunk V2 MiniUpdate Nexus NightLedger Nimbus Manticore PUBLOAD Payload Payload Phishing campaigns PowerShell STOP Setup.exe Showboat Smoke Sandstorm Snake Spear-phishing Trojan UNC1549 Unknown Vidar Vidar stealer WildFire XCSSET YARA npm packages phishing

Indicators of Compromise (40)

Domain
webmail.rpcthai.com docspace-y4cumb.onlyoffice.com 2117.filemail.com PremierHealthAdvisory.com PremierHealthAdvisory.azurewebsites.net Premier-HealthAdvisory.azurewebsites.net Ramiltonsfinance.com Ramiltons-finance.azurewebsites.net +8 more
Filename
SoftwareLicencing.exe content.zip Platform.zip JR205894.pdf version.dll Updater.dll seccenter.exe wmiprvse.exe +14 more
MD5 Hash
edcdba624ddb43c2a1dcf334aa493068
SHA-256 Hash
11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (13)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +8 more
Installation (2)
M1018 User Account Management M1028 Operating System Configuration
Command & Control (5)
M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1038 Execution Prevention M1042 Disable or Remove Feature or Program
Actions on Objectives (17)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +12 more

Detection Coverage

40 strategies
5/7 stages covered

Delivery (3)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0018 Behavior-chain, platform-aware detection... DET0202 Behavioral Detection of Windows Command... DET0388 Detection Strategy for T1548.002 – Bypas... DET0441 Detection of Suspicious Scheduled Task C... DET0516 Behavioral Detection of Command and Scri...

Installation (11)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0043 Detection Strategy for System Location D... DET0093 Behavioral Detection of User Discovery v... DET0182 Behavior-chain detection for T1135 Netwo... +6 more

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0341 Clipboard Data Access with Anomalous Con... DET0444 Detection of Command and Control Over Ap... DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (17)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0127 Behavioral Detection of Masquerading Acr... DET0128 Detection Strategy for Hidden Windows DET0146 Detection of Data Destruction Across Pla... DET0168 Virtualization/Sandbox Evasion via Syste... +12 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

screening serpens

Type: Unknown Active
Smoke Sandstorm UNC1549 Iranian Dream Job tracked as 2023 +23 more
Infrastructure 16 IOC(s)
50%
Domain
webmail.rpcthai.com docspace-y4cumb.onlyoffice.com 2117.filemail.com PremierHealthAdvisory.com PremierHealthAdvisory.azurewebsites.net +11
Artifacts (24)
SoftwareLicencing.exe content.zip Platform.zip JR205894.pdf version.dll Updater.dll +18
Capability
50%
40 technique(s) 45 tool(s)/malware 1 CVE(s)
AppDomainManager Backdoors CALENDAR CLAIMLOADER ClickFix Crimson Custom tools Dark +37
collection
T1115
command and control
T1071 T1071.001 T1219
defense impairment
T1222 T1553.002
discovery
T1012 T1033 T1057 T1082 +6
Victim
70%

Targeted Sectors

aerospace defense communications government financial-services manufacturing telecommunications information-technology construction energy healthcare aviation critical-infrastructure education media non-profit utilities transportation oil-gas maritime retail pharmaceutical legal-services

Targeted Countries

United States of America Israel United Arab Emirates AE IR US IL CN IN JP UA TR BY KP KZ VN EG SG FR BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001 T1566.002

Capability (Malware)

AppDomainManager Backdoors CALENDAR
4 Exploitation

Capability (Malware)

AppDomainManager Backdoors CALENDAR
5 Installation

Capability (Malware)

AppDomainManager Backdoors CALENDAR
6 Command & Control

Capability (Malware)

AppDomainManager Backdoors CALENDAR
7 Actions on Objectives

Capability (Techniques)

T1485 T1486

Capability (Malware)

AppDomainManager Backdoors CALENDAR
Leaving Threaticon

This link opens an external site that isn't part of the platform.