Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Axiom (threat actor)
Risk
93
Critical
30 techniques 52 tools/malware 4 vulnerabilities 21 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
11
T1583
Acquire Infrastructure resource development
T1583.002
DNS Server resource development
T1583.003
Virtual Private Server resource development
T1584
Compromise Infrastructure resource development
T1584.005
Botnet resource development
T1585.001
Social Media Accounts resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1587.002
Code Signing Certificates resource development
T1587.003
Digital Certificates resource development
T1587.004
Exploits resource development
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
›
4 Exploitation
8
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1546
Event Triggered Execution privilege escalation
T1546.008
Accessibility Features privilege escalation
CVE CVE-2012-1889
CVE CVE-2012-4792
CVE CVE-2013-3893
CVE CVE-2014-0322
›
5 Installation
2
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
›
6 Command & Control
8
T1005
Data from Local System collection
T1560
Archive Collected Data collection
T1001
Data Obfuscation command and control
T1001.002
Steganography command and control
T1021
Remote Services lateral movement
T1021.001
Remote Desktop Protocol lateral movement
T1563
Remote Service Session Hijacking lateral movement
T1563.002
RDP Hijacking lateral movement
›
7 Actions on Objectives
2
T1553
Subvert Trust Controls defense impairment
T1078
Valid Accounts stealth
Stage risk: Critical High Medium None

Tools & Malware (52)

APT38 Akira AppleJeus BLACKCOFFEE Backdoors BlackByte Carbanak Chimera Cobalt Confucius Custom malware Dark Deputy Dog Derusbi Derusbi Derusbi Fscan GHC0ST RAT Global HDRoot HTRAN Hafnium Hikit Hydraq Kimsuky Latrodectus Machete Medusa Moonstone Sleet MuddyWater Naikon Nexus OilRig Olympic Destroyer PLAY PlugX PoisonIvy RedCurl Remote access tools ShadowPad SideWinder SolarWinds TeamTNT Timestomper Turla Void Winnti Zox ZxShell gh0st RAT malware distribution phishing

Indicators of Compromise (21)

Domain
TEMP.MixMaster TEMP.Zagros ASP.NET TEMP.Jumper TEMP.Periscope TEMP.Hex MailFetch.py Justicehomeland.org +10 more
Email Address
rocke@live.cn
Filename
enterprise-attack-v13.1-groups.xlsx enterprise-attack-v15.1-groups.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (14)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more
Exploitation (7)
M1026 Privileged Account Management M1028 Operating System Configuration M1035 Limit Access to Resource Over Network M1038 Execution Prevention M1048 Application Isolation and Sandboxing +2 more
Installation (9)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more
Command & Control (11)
M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +6 more
Actions on Objectives (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1024 Restrict Registry Permissions +7 more

Detection Coverage

30 strategies
6/7 stages covered

Weaponization (11)

DET0833 Detection of Code Signing Certificates DET0838 Detection of Virtual Private Server DET0844 Detection of Digital Certificates DET0851 Detection of Social Media Accounts DET0853 Detection of Develop Capabilities +6 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (4)

DET0010 Behavioral Detection of Event Triggered... DET0033 Detection Strategy for Accessibility Fea... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros...

Installation (2)

DET0234 Credential Dumping via Sensitive Memory... DET0363 Detection of Credential Dumping from LSA...

Command & Control (8)

DET0053 Detect Obfuscated C2 via Network Traffic... DET0079 Detection of Remote Service Session Hija... DET0235 Detecting Steganographic Command and Con... DET0269 Behavioral Detection Strategy for Remote... DET0327 Multi-event Detection Strategy for RDP-B... +3 more

Actions on Objectives (2)

DET0452 Detect Subversion of Trust Controls via... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Axiom

Type: Unknown Active
Group 72 APT17 Tailgater Team Dogfish (iDefense) Deputy Dog (iDefense) +17 more
Infrastructure 18 IOC(s)
50%
Domain
TEMP.MixMaster TEMP.Zagros ASP.NET TEMP.Jumper TEMP.Periscope +13
Artifacts (3)
rocke@live.cn enterprise-attack-v13.1-groups.xlsx enterprise-attack-v15.1-groups.xlsx
Capability
71%
30 technique(s) 52 tool(s)/malware 4 CVE(s)
APT38 Akira AppleJeus BLACKCOFFEE Backdoors BlackByte Carbanak Chimera +44
collection
T1005 T1560
command and control
T1001 T1001.002
credential access
T1003 T1003.001
defense impairment
T1553
Victim
70%

Targeted Sectors

government defense aerospace & defense ngo financial-services telecommunications manufacturing healthcare education media energy aerospace critical-infrastructure non-profit pharmaceutical aviation information-technology transportation retail chemical think-tank maritime mining utilities oil-gas legal-services nuclear entertainment construction hospitality gaming

Targeted Countries

US CN RU JP TW IR PK VN IL GB AU SA AE UA PL SG KR IN DE MX BY TR ES KP CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 Akira AppleJeus
3 Delivery

Capability (Techniques)

T1189 T1190 T1566

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Techniques)

T1003 T1003.001

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.