Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Silent Librarian (threat actor)

Risk

Medium

13 techniques 0 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.002

Email Addresses reconnaissance

T1589.003

Employee Names reconnaissance

T1594

Search Victim-Owned Websites reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1585.002

Email Accounts resource development

T1588.002

Tool resource development

T1588.004

Digital Certificates resource development

T1608.005

Link Target resource development

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

T1110.003

Password Spraying credential access

›

6 Command & Control

T1114

Email Collection collection

T1114.003

Email Forwarding Rule collection

›

7 Actions on Objectives

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1017 User Training M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Installation (3)

M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (5)

M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information M1042 Disable or Remove Feature or Program M1047 Audit M1060 Out-of-Band Communications Channel

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

13 strategies

5/7 stages covered

Reconnaissance (4)

DET0810 Detection of Search Victim-Owned Website... DET0814 Detection of Email Addresses DET0857 Detection of Employee Names DET0878 Detection of Spearphishing Link

Weaponization (5)

DET0835 Detection of Email Accounts DET0848 Detection of Digital Certificates DET0852 Detection of Tool DET0892 Detection of Domains DET0893 Detection of Link Target

Installation (1)

DET0487 Distributed Password Spraying via Authen...

Command & Control (2)

DET0476 Email Collection via Local Email Access... DET0576 Email Forwarding Rule Abuse Detection Ac...

Actions on Objectives (1)

DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Silent Librarian

Type: Unknown Active

TA407 COBALT DICKENS Silent Librarian Mabna Institute TA4900 +2 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

13 technique(s)

collection

T1114 T1114.003

credential access

T1110.003

reconnaissance

T1589.002 T1589.003 T1594 T1598.003

resource development

T1583.001 T1585.002 T1588.002 T1588.004 +1

Victim

70%

Targeted Sectors

government

Targeted Countries

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.002 T1589.003 T1594 T1598.003

Capability (Malware)

—

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583.001 T1585.002 T1588.002 T1588.004 T1608.005

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1110.003

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1114 T1114.003

Capability (Malware)

—

Infrastructure

No infra linked