Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

4bid (threat actor)

Risk

Critical

62 techniques 164 tools/malware 13 vulnerabilities 34 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195

Supply Chain Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

T1059.007

JavaScript execution

T1106

Native API execution

T1204

User Execution execution

T1204.001

Malicious Link execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1546.003

Windows Management Instrumentation Event Subscription privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

›

5 Installation

T1003

OS Credential Dumping credential access

T1003.001

LSASS Memory credential access

T1003.002

Security Account Manager credential access

T1003.006

DCSync credential access

T1040

Network Sniffing credential access

T1110

Brute Force credential access

T1552

Unsecured Credentials credential access

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1098

Account Manipulation persistence

T1136.001

Local Account persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1074

Data Staged collection

T1113

Screen Capture collection

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1090

Proxy command and control

T1104

Multi-Stage Channels command and control

T1105

Ingress Tool Transfer command and control

T1021

Remote Services lateral movement

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1484.002

Trust Modification defense impairment

T1578.001

Create Snapshot defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

T1498.001

Direct Network Flood impact

T1529

System Shutdown/Reboot impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1078

Valid Accounts stealth

T1574.001

DLL stealth

T1574.004

Dylib Hijacking stealth

T1574.009

Path Interception by Unquoted Path stealth

T1036.015

T1043

T1064

T1070.002

T1076

T1081

T1086

T1498.004

T1515

T1574.003

Stage risk: Critical High Medium None

Tools & Malware (164)

ADRecon Advanced IP Scanner Agenda ransomware binary Akira Akira ransomware Anthropic Claude LLM AnyDesk AsyncRAT Atera RMM platform BADAUDIO BLOODALCHEMY BRICKSTORM Babuk Backdoors BadAudio BlackReaperRAT Blackout Locker BloodHound Broadside (Mirai variant) Broadside Botnet C5 backdoor COROXY backdoor CalaRat Chaos Chisel ClearWater ClearWater ransomware CloudAtlas backdoor CloudFlared Cloudflare Workers Cobalt Cobalt Strike Cobint Comebacker ConfuserEx CrackMapExec Custom Python credential extraction script Custom scripts DCRat DCSYNCER.SLICK DCSyncer DEEPROOT DaemonicLogistics Dark Dev Tunnels EchoGather EdgeStepper Endurance-Wiper Explorer Export-Alias FaceFish FileGrabber Fleetdeck Fooder FormBook Fscan GHOSTLINE GOST GTG-1002 Malware GalaxyGato Global GoRed GoRed (Bulldog) GuestConduit Impacket Impacket wmiexec.py Imperial Kitten InfoCollector JavaScript payloads Junction Katz Stealer Kimsuky LittleDaemon LockBit LockBit 3.0 LogMeIn Resolve Malicious downloaders Megazord Mimikatz MuPDF MuddyViper MuddyWater Mythic agent NSSM NeuralExecutor Neursite Nmap Notepad++ N‑able OPENVAS OceanLotus PDQ Connect PEASS PEBBLEDASH POLLBLEND Panorama9 Panorama9 RMM PasswordStealer Pay2Key Payload Payload PhantomVAI PhantomVAI loader Phishing emails PowerShell PowerShell scripts PowerShower PS script PowerView ProcDump PsExec PuTTY PuTTY SSH client PureCrypter PureHVNC/PureRAT PureLogs Stealer RClone Red Likho RemCom Revsocks Rust dropper RustVoralix SQLMap ScoringMathTea ScreenConnect Set-Alias Sharp7Extend SimpleHelp SlowStepper SocGholish Spear-phishing Splashtop Remote (SRManager.exe) SpyDealer Sting TWOSTROKE Telegram TightVNC Viewer Tuoni UNC1549 Unknown VAX‑One VBCloud VBS files VBScript VBShower VIPERTUNNEL Velociraptor Visual Studio Code Void Warlock Warp Warp RAT WinDealer WinMerge Windows Subsystem for Linux (WSL) XWorm XenAllPasswordPro YARA ZEROLOT ZeronetKit grabff kidsRAT ngrok nltest patched Process Explorer phishing

Indicators of Compromise (34)

Domain

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui Microsoft.PowerShell.Utility cpuid.com unpkg.com batyrevkras.ru viewtools.txt +6 more

Email Address

ics-cert@kaspersky.com

Filename

enc.exe cmd.exe MMpLics.dll Excel.exe anydesk.exe twelve.exe Notepad.exe virtualhelper.exe +7 more

MD5 Hash

a9e90784a9385bda054ffaef6fd6f8c3 c06495ed040f806cfbff31e3c47cc67e

IPv4 Address

185.221.153.121 7.0.0.0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (18)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more

Exploitation (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Installation (20)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +15 more

Command & Control (9)

M1018 User Account Management M1020 SSL/TLS Inspection M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +4 more

Actions on Objectives (22)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +17 more

Detection Coverage

52 strategies

5/7 stages covered

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (12)

DET0066 User Execution – Malicious Link (click →... DET0086 Detect WMI Event Subscription for Persis... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... +7 more

Installation (12)

DET0085 Credential Dumping from SAM via Registry... DET0096 Account Manipulation Behavior Chain Dete... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0314 Detection Strategy for Network Sniffing... +7 more

Command & Control (9)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0228 Detect Multi-Stage Command and Control C... DET0269 Behavioral Detection Strategy for Remote... +4 more

Actions on Objectives (14)

DET0064 Detection Strategy for Hijack Execution... DET0127 Behavioral Detection of Masquerading Acr... DET0152 Detection Strategy for Hijack Execution... DET0184 Behavioral Detection of Indicator Remova... DET0201 Detection Strategy for Hijack Execution... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

4bid

Type: Unknown Active

SHADOW-VOID-042 Storm-0978 Tropical Scorpius APT44 Seashell Blizzard +25 more

Infrastructure 16 IOC(s)

50%

Domain

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui Microsoft.PowerShell.Utility cpuid.com +9

IPv4 Address

185.221.153.121 7.0.0.0

Artifacts (18)

ics-cert@kaspersky.com enc.exe cmd.exe MMpLics.dll Excel.exe anydesk.exe +12

Capability

50%

62 technique(s) 164 tool(s)/malware 13 CVE(s)

ADRecon Advanced IP Scanner Agenda ransomware binary Akira Akira ransomware Anthropic Claude LLM AnyDesk AsyncRAT +156

T1036.015 T1043 T1064 T1070.002 +6

collection

T1074 T1113

command and control

T1071.001 T1071.004 T1090 T1104 +1

credential access

T1003 T1003.001 T1003.002 T1003.006 +3

Victim

70%

Targeted Sectors

healthcare government manufacturing aerospace financial-services transportation defense energy critical-infrastructure food-agriculture pharmaceutical chemical retail education construction telecommunications media utilities aviation maritime oil-gas information-technology entertainment

Targeted Countries

Belarus Egypt Kazakhstan Russian Federation Syrian Arab Republic United Arab Emirates RU CN US AE BR EG SY KZ BY UA IL IR TW FR CA GB DE IN MX SA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1195 T1566 T1566.001 T1566.002

Capability (Malware)

ADRecon Advanced IP Scanner Agenda ransomware binary

Infrastructure

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui

4 Exploitation

Capability (Techniques)

T1053 T1053.005 T1059 T1059.001 T1059.003

Capability (Malware)

ADRecon Advanced IP Scanner Agenda ransomware binary

Infrastructure

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui

5 Installation

Capability (Techniques)

T1003 T1003.001 T1003.002 T1003.006 T1040

Capability (Malware)

ADRecon Advanced IP Scanner Agenda ransomware binary

Infrastructure

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui

6 Command & Control

Capability (Techniques)

T1074 T1113 T1071.001 T1071.004 T1090

Capability (Malware)

ADRecon Advanced IP Scanner Agenda ransomware binary

Infrastructure

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui

7 Actions on Objectives

Capability (Techniques)

T1041 T1486 T1498.001 T1529

Capability (Malware)

ADRecon Advanced IP Scanner Agenda ransomware binary

Infrastructure

SqlUnicorn.Core wmiexec.py MsMpCon.dll.mui