Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT28 (threat actor)
Risk
100
Critical
126 techniques 60 tools/malware 10 vulnerabilities 34 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
7
T1589.001
Credentials reconnaissance
T1591
Gather Victim Org Information reconnaissance
T1595
Active Scanning reconnaissance
T1595.002
Vulnerability Scanning reconnaissance
T1596
Search Open Technical Databases reconnaissance
T1598
Phishing for Information reconnaissance
T1598.003
Spearphishing Link reconnaissance
›
2 Weaponization
13
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.002
DNS Server resource development
T1583.003
Virtual Private Server resource development
T1583.006
Web Services resource development
T1584
Compromise Infrastructure resource development
T1584.008
Network Devices resource development
T1585
Establish Accounts resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1588.002
Tool resource development
T1588.006
Vulnerabilities resource development
T1588.007
Artificial Intelligence resource development
›
3 Delivery
6
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1199
Trusted Relationship initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
T1669
Wi-Fi Networks initial access
›
4 Exploitation
20
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1559.002
Dynamic Data Exchange execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1546
Event Triggered Execution privilege escalation
T1546.015
Component Object Model Hijacking privilege escalation
CVE CVE-2014-4076
CVE CVE-2015-1701
CVE CVE-2015-2387
CVE CVE-2015-4902
CVE CVE-2017-0262
CVE CVE-2017-0263
CVE CVE-2017-6742
CVE CVE-2022-38028
CVE CVE-2023-50224
CVE CVE-2026-21509
›
5 Installation
26
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1003.003
NTDS credential access
T1040
Network Sniffing credential access
T1110
Brute Force credential access
T1110.001
Password Guessing credential access
T1110.003
Password Spraying credential access
T1528
Steal Application Access Token credential access
T1557
Adversary-in-the-Middle credential access
T1557.004
Evil Twin credential access
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1046
Network Service Discovery discovery
T1057
Process Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1120
Peripheral Device Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1037.001
Logon Script (Windows) persistence
T1098
Account Manipulation persistence
T1098.002
Additional Email Delegate Permissions persistence
T1133
External Remote Services persistence
T1137.002
Office Test persistence
T1505.003
Web Shell persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
34
T1005
Data from Local System collection
T1025
Data from Removable Media collection
T1039
Data from Network Shared Drive collection
T1056.001
Keylogging collection
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1074.002
Remote Data Staging collection
T1113
Screen Capture collection
T1114
Email Collection collection
T1114.002
Remote Email Collection collection
T1119
Automated Collection collection
T1213
Data from Information Repositories collection
T1213.002
Sharepoint collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1001
Data Obfuscation command and control
T1001.001
Junk Data command and control
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.003
Mail Protocols command and control
T1090
Proxy command and control
T1090.002
External Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1092
Communication Through Removable Media command and control
T1102.002
Bidirectional Communication command and control
T1105
Ingress Tool Transfer command and control
T1573
Encrypted Channel command and control
T1573.001
Symmetric Cryptography command and control
T1021
Remote Services lateral movement
T1021.002
SMB/Windows Admin Shares lateral movement
T1091
Replication Through Removable Media lateral movement
T1210
Exploitation of Remote Services lateral movement
T1550.001
Application Access Token lateral movement
T1550.002
Pass the Hash lateral movement
›
7 Actions on Objectives
30
T1600
Weaken Encryption defense impairment
T1685
Disable or Modify Tools defense impairment
T1685.005
Clear Windows Event Logs defense impairment
T1686
Disable or Modify System Firewall defense impairment
T1030
Data Transfer Size Limits exfiltration
T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1489
Service Stop impact
T1498
Network Denial of Service impact
T1561
Disk Wipe impact
T1006
Direct Volume Access stealth
T1014
Rootkit stealth
T1027.013
Encrypted/Encoded File stealth
T1036
Masquerading stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T1134
Access Token Manipulation stealth
T1134.001
Token Impersonation/Theft stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1211
Exploitation for Stealth stealth
T1218.011
Rundll32 stealth
T1221
Template Injection stealth
T1542.003
Bootkit stealth
T1564.001
Hidden Files and Directories stealth
T1564.003
Hidden Window stealth
T1684.001
Impersonation stealth
T164+
T164+
Stage risk: Critical High Medium None

Tools & Malware (60)

ADVSTORESHELL Athena CHOPSTICK CORESHELL Cannon DNS hijacking DealersChoice DownRange Downdelph Drovorub Foozer Forfiles Fysbis Global Globe Google Drive Grizzly Steppe HIDEDRV Headlace JHUHUGIT Koadic Komplex LAMEHUG Leverage LoJax Mimikatz OCEANMAP OLDBAIT Payload Phishing campaigns Phishing emails PowerShell Responder Rootkit Rundll32 SOURFACE Sedkit Sednit Sedreco Dropper Sofacy Spear-phishing Spear-phishing emails Trojan USBStealer Web Shell WinIDS Windows Command Shell Winexe Winrar Wi‑Fi Pineapple XAgent XAgentOSX XTunnel Zebrocy certutil cipher.exe netsh phishing reGeorg route

Indicators of Compromise (34)

Domain
electronicfrontierfoundation.org ukr.net UKR.net Bit.ly Hillaryclinton.com outlook.office365.com NTDS.dit pi.log +1 more
Filename
cipher.exe ntdsutil.exe FBI.pdf cmd.exe explorer.exe rundll32.exe
IPv4 Address
37.221.64.93 37.221.64.101 37.221.64.116 37.221.64.131 37.221.64.148 1.2.3.4 5.226.137.151 5.226.137.230 +11 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

41 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (3)
M1017 User Training M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (17)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +12 more
Exploitation (16)
M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +11 more
Installation (23)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +18 more
Command & Control (29)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +24 more
Actions on Objectives (32)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +27 more

Detection Coverage

125 strategies
7/7 stages covered

Reconnaissance (7)

DET0813 Detection of Credentials DET0823 Detection of Phishing for Information DET0830 Detection of Active Scanning DET0860 Detection of Search Open Technical Datab... DET0867 Detection of Vulnerability Scanning +2 more

Weaponization (13)

DET0808 Detection of Vulnerabilities DET0838 Detection of Virtual Private Server DET0842 Detection of Artificial Intelligence DET0852 Detection of Tool DET0859 Detection of Network Devices +8 more

Delivery (6)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... DET0488 Detect abuse of Trusted Relationships (t... +1 more

Exploitation (10)

DET0010 Behavioral Detection of Event Triggered... DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +5 more

Installation (26)

DET0034 Detection of Adversarial Process Discove... DET0072 Detect Logon Script Modifications and Ex... DET0096 Account Manipulation Behavior Chain Dete... DET0112 Boot or Logon Initialization Scripts Det... DET0195 Behavioral Detection of System Network C... +21 more

Command & Control (34)

DET0011 Detecting Junk Data in C2 Channels via B... DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0048 Detect Remote Email Collection via Abnor... +29 more

Actions on Objectives (29)

DET0021 Behavioral Detection for Service Stop ac... DET0032 Detection Strategy for Hidden Files and... DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0128 Detection Strategy for Hidden Windows +24 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

APT28

Type: Unknown Active
IRON TWILIGHT SNAKEMACKEREL Swallowtail Group 74 Sednit +48 more
Infrastructure 28 IOC(s)
50%
Domain
electronicfrontierfoundation.org ukr.net UKR.net Bit.ly Hillaryclinton.com +4
IPv4 Address
37.221.64.93 37.221.64.101 37.221.64.116 37.221.64.131 37.221.64.148 +14
Artifacts (6)
cipher.exe ntdsutil.exe FBI.pdf cmd.exe explorer.exe rundll32.exe
Capability
80%
126 technique(s) 60 tool(s)/malware 10 CVE(s)
ADVSTORESHELL Athena CHOPSTICK CORESHELL Cannon DNS hijacking DealersChoice DownRange +52
T164+
collection
T1005 T1025 T1039 T1056.001 +11
command and control
T1001 T1001.001 T1071 T1071.001 +9
credential access
T1003 T1003.001 T1003.003 T1040 +6
Victim
70%

Targeted Sectors

government defense energy healthcare transportation aviation hospitality chemical think-tank information-technology media financial-services maritime critical-infrastructure non-profit telecommunications nuclear oil-gas education construction utilities

Targeted Countries

US RU UA GB CN FR TR NL RO DE KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
2 Weaponization

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
3 Delivery

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
4 Exploitation

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
5 Installation

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
6 Command & Control

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
7 Actions on Objectives

Capability (Malware)

ADVSTORESHELL Athena CHOPSTICK
Leaving Threaticon

This link opens an external site that isn't part of the platform.