Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
o1oo1 (threat actor)
Risk
88
Critical
54 techniques 45 tools/malware 1 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
1
T1583
Acquire Infrastructure resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
›
4 Exploitation
7
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1204
User Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2026-35273
›
5 Installation
14
T1539
Steal Web Session Cookie credential access
T1552
Unsecured Credentials credential access
T1555
Credentials from Password Stores credential access
T1557
Adversary-in-the-Middle credential access
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1518
Software Discovery discovery
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
12
T1056
Input Capture collection
T1113
Screen Capture collection
T1114
Email Collection collection
T1115
Clipboard Data collection
T1185
Browser Session Hijacking collection
T1530
Data from Cloud Storage collection
T1560
Archive Collected Data collection
T1001
Data Obfuscation command and control
T1071
Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1571
Non-Standard Port command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
18
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1498
Network Denial of Service impact
T1499
Endpoint Denial of Service impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1134
Access Token Manipulation stealth
T1218
System Binary Proxy Execution stealth
T1480
Execution Guardrails stealth
T1497
Virtualization/Sandbox Evasion stealth
T1060
T1060
T1521
T1521
T1562
T1562
Stage risk: Critical High Medium None

Tools & Malware (45)

AppDomainManager AsmCrypt BITS Backdoors BlackSuit ClickFix Cobalt Cobalt Strike Conti Dark GitHub Global Group Policy Hook Hooks Interception KongTuke Leverage LockBit LummaC2 Lynx MSBuild Mythic Netsh Netsupport Manager Payload Payload PowerShell Process Hollowing Qilin Ransomware variants Remote access tools Royal Royal Ransomware SilabRAT SnappyClient SocGholish TONESHELL Toneshell Trojan Windows Command Shell inter netsh phishing systemd

Indicators of Compromise (39)

Domain
sitecustomize.py usercustomize.py pastebin.com webhook.site com.apple com.apple.quarantine com.apple.metadata com.apple.loginwindow +4 more
Filename
vmtoolsd.exe Target.dll Netsh.exe netsh.exe ntsd.exe notepad.exe pcalua.exe Scriptrunner.exe +14 more
SHA-256 Hash
3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b 79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5 fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623 fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023
IPv4 Address
91.199.163.124

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

35 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (14)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more
Exploitation (19)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more
Installation (18)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more
Command & Control (13)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1027 Password Policies M1030 Network Segmentation +8 more
Actions on Objectives (23)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +18 more

Detection Coverage

51 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (1)

DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (6)

DET0094 Cross-Platform Behavioral Detection of S... DET0345 Detection Strategy for Abuse Elevation C... DET0364 Behavioral Detection Strategy for WMI Ex... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for... +1 more

Installation (14)

DET0013 Detection of Local Browser Artifact Acce... DET0034 Detection of Adversarial Process Discove... DET0096 Account Manipulation Behavior Chain Dete... DET0274 Boot or Logon Autostart Execution Detect... DET0296 Detect Adversary-in-the-Middle via Netwo... +9 more

Command & Control (12)

DET0053 Detect Obfuscated C2 via Network Traffic... DET0060 Detect Ingress Tool Transfers via Behavi... DET0102 Behavioral Detection of Input Capture Ac... DET0227 Detection Strategy for Non-Standard Port... DET0269 Behavioral Detection Strategy for Remote... +7 more

Actions on Objectives (15)

DET0046 Detection Strategy for T1497 Virtualizat... DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0208 Endpoint Resource Saturation and Crash P... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

o1oo1

Type: Unknown Active
Stately Taurus Earth Preta among other monikers tracked as services +20 more
Infrastructure 13 IOC(s)
50%
Domain
sitecustomize.py usercustomize.py pastebin.com webhook.site com.apple +7
IPv4 Address
91.199.163.124
Artifacts (26)
vmtoolsd.exe Target.dll Netsh.exe netsh.exe ntsd.exe notepad.exe +20
Capability
50%
54 technique(s) 45 tool(s)/malware 1 CVE(s)
AppDomainManager AsmCrypt BITS Backdoors BlackSuit ClickFix Cobalt Cobalt Strike +37
T1060 T1521 T1562
collection
T1056 T1113 T1114 T1115 +3
command and control
T1001 T1071 T1105 T1571
credential access
T1539 T1552 T1555 T1557
Victim
70%

Targeted Sectors

financial-services defense government healthcare media education manufacturing telecommunications critical-infrastructure construction information-technology retail non-profit hospitality transportation aerospace maritime nuclear entertainment gaming food-agriculture

Targeted Countries

CN RU IN UA GB DE KP IR PK BY PL TW CA AU US AE

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

AppDomainManager AsmCrypt BITS
2 Weaponization

Capability (Techniques)

T1583

Capability (Malware)

AppDomainManager AsmCrypt BITS
3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

AppDomainManager AsmCrypt BITS
4 Exploitation

Capability (Malware)

AppDomainManager AsmCrypt BITS
5 Installation

Capability (Malware)

AppDomainManager AsmCrypt BITS
6 Command & Control

Capability (Malware)

AppDomainManager AsmCrypt BITS
7 Actions on Objectives

Capability (Malware)

AppDomainManager AsmCrypt BITS
Leaving Threaticon

This link opens an external site that isn't part of the platform.