Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
jinx-0164 (threat actor)
Risk
86
Critical
56 techniques 48 tools/malware 5 vulnerabilities 18 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
13
T1059.013
Container CLI/API execution
T1129
Shared Modules execution
T1559
Inter-Process Communication execution
T1559.001
Component Object Model execution
T1559.002
Dynamic Data Exchange execution
T1559.003
XPC Services execution
T1610
Deploy Container execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2026-0257
CVE CVE-2026-20230
CVE CVE-2026-26980
CVE CVE-2026-48131
CVE CVE-2026-48132
›
5 Installation
10
T1558
Steal or Forge Kerberos Tickets credential access
T1558.001
Golden Ticket credential access
T1558.002
Silver Ticket credential access
T1558.003
Kerberoasting credential access
T1558.004
AS-REP Roasting credential access
T1558.005
Ccache Files credential access
T1124
System Time Discovery discovery
T1135
Network Share Discovery discovery
T1518.002
Backup Software Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
10
T1123
Audio Capture collection
T1125
Video Capture collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1560.002
Archive via Library collection
T1560.003
Archive via Custom Method collection
T1132.001
Standard Encoding command and control
T1132.002
Non-Standard Encoding command and control
T1550
Use Alternate Authentication Material lateral movement
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
28
T1490
Inhibit System Recovery impact
T1498
Network Denial of Service impact
T1127
Trusted Developer Utilities Proxy Execution stealth
T1127.001
MSBuild stealth
T1127.002
ClickOnce stealth
T1127.003
JamPlus stealth
T1134
Access Token Manipulation stealth
T1134.001
Token Impersonation/Theft stealth
T1134.002
Create Process with Token stealth
T1134.003
Make and Impersonate Token stealth
T1134.004
Parent PID Spoofing stealth
T1134.005
SID-History Injection stealth
T1030 – Data Transfer Size Limits
T1030 – Data Transfer Size Limits
T1055 – Process Injection
T1055 – Process Injection
T1059.013 – Container CLI/API
T1059.013 – Container CLI/API
T1060 – Registry Run Keys / Startup Folder
T1060 – Registry Run Keys / Startup Folder
T1078 – Valid Accounts
T1078 – Valid Accounts
T1086 – PowerShell
T1086 – PowerShell
T1105 – Ingress Tool Transfer
T1105 – Ingress Tool Transfer
T1123 – Audio Capture
T1123 – Audio Capture
T1132.001 – Standard Encoding
T1132.001 – Standard Encoding
T1134.003 – Make/Impersonate Token
T1134.003 – Make/Impersonate Token
T1134.004 – Parent PID Spoofing
T1134.004 – Parent PID Spoofing
T1195 – Supply Chain Compromise
T1195 – Supply Chain Compromise
T1557 – Steal or Forge Kerberos Ticket (AS-REP, Silver Ticket)
T1557 – Steal or Forge Kerberos Ticket (AS-REP, Silver Ticket)
T1560.001 – Archive via Utility
T1560.001 – Archive via Utility
T1566.001 – Phishing: Spear‑phishing attachment
T1566.001 – Phishing: Spear‑phishing attachment
T1566.002 – Phishing: Spear‑phishing link
T1566.002 – Phishing: Spear‑phishing link
Stage risk: Critical High Medium None

Tools & Malware (48)

@velora-dex/sdk (Trojanized npm package) AUDIOFIX AdWind AppDomainManager Atlas RAT BITS BOOKWORM BeaverTail BlackSuit CALENDAR Chaos DCSync GitHub GitHub CLI tooling Global GoSerpent Grandoreiro Group Policy Havex RAT Hook Interception LockBit MINIRAT MSBuild Matrix Medusa Msiexec MuddyWater Payload Payload PowerShell Process Hollowing REvil Remote access tools Rogue Rootkit Rundll32 STOP Telegram VPN services used for C2 obfuscation Web Shell Windows Command Shell inter lockscreen mshta netsh phishing systemd

Indicators of Compromise (18)

Domain
driver-updater.net login.teamicrosoft.com live.ong NTDS.dit macOS.OSAMiner Hunt.io tcpdump101.com shafiaipro.com +1 more
Filename
spoolsv.exe InstallUtil.exe control.exe CMSTP.exe hh.exe mavinject.exe SyncAppvPublishingServer.vbs PubPrn.vbs +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (15)
M1013 Application Developer Guidance M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more
Installation (12)
M1015 Active Directory Configuration M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +7 more
Command & Control (10)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +5 more
Actions on Objectives (10)
M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +5 more

Detection Coverage

40 strategies
4/7 stages covered

Exploitation (8)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... DET0335 Detect Abuse of XPC Services (T1559.003) +3 more

Installation (10)

DET0024 Detect Kerberos Ccache File Theft or Abu... DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0144 Detect Forged Kerberos Golden Tickets (T... DET0151 Behavior-chain, platform-aware detection... +5 more

Command & Control (10)

DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... DET0221 Behavioral Detection Strategy for T1123... DET0268 Detect Archiving via Library (T1560.002) +5 more

Actions on Objectives (12)

DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0283 Behavior-chain detection for T1134 Acces... DET0329 Behavioral Detection for T1490 - Inhibit... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

jinx-0164

Type: Unknown Active
tracked as Sleet
Infrastructure 9 IOC(s)
50%
Domain
driver-updater.net login.teamicrosoft.com live.ong NTDS.dit macOS.OSAMiner +4
Artifacts (9)
spoolsv.exe InstallUtil.exe control.exe CMSTP.exe hh.exe mavinject.exe +3
Capability
50%
56 technique(s) 48 tool(s)/malware 5 CVE(s)
@velora-dex/sdk (Trojanized npm package) AUDIOFIX AdWind AppDomainManager Atlas RAT BITS BOOKWORM BeaverTail +40
T1030 – Data Transfer Size Limits T1055 – Process Injection T1059.013 – Container CLI/API T1060 – Registry Run Keys / Startup Folder +12
collection
T1123 T1125 T1560 T1560.001 +2
command and control
T1132.001 T1132.002
credential access
T1558 T1558.001 T1558.002 T1558.003 +2
Victim
70%

Targeted Sectors

financial-services critical-infrastructure telecommunications manufacturing government gaming hospitality

Targeted Countries

US RU IR MX ES

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives

Capability (Techniques)

T1490 T1498
Leaving Threaticon

This link opens an external site that isn't part of the platform.