Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

unc3753 (threat actor)

Risk

Critical

31 techniques 53 tools/malware 1 vulnerabilities 18 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1204.002

Malicious File execution

T1569.002

Service Execution execution

CVE CVE-2023-3519

›

5 Installation

T1003.001

LSASS Memory credential access

T1003.002

Security Account Manager credential access

T1046

Network Service Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1133

External Remote Services persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074

Data Staged collection

T1219

Remote Access Tools command and control

T1572

Protocol Tunneling command and control

T1021

Remote Services lateral movement

T1021.001

Remote Desktop Protocol lateral movement

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1052.001

Exfiltration over USB exfiltration

T1537

Transfer Data to Cloud Account exfiltration

T1567.002

Exfiltration to Cloud Storage exfiltration

T1486

Data Encrypted for Impact impact

T1027

Obfuscated Files or Information stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1070.001

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (53)

AnyDesk Aurora BAZARLOADER loader BRICKSTORM BazarLoader Bomgar CALENDAR Citrix Workspace/Client Clop Conti Conti Ransomware Dark Fake IT support GitHub GoSerpent Google Drive Group Policy Guard LOCKBIT.BLACK ransomware (historical) LockBit Luna Microsoft OneDrive Microsoft Teams Msiexec PHOTO Payload Payload Phishing campaigns Phishing emails Phishing kits PowerShell Privnote.com Quick Assist Rclone Remote access tools Ryuk SILENTNIGHT toolset STOP Stealc SuperOps RMM agent TRICKBOT botnet TrickBot URNSNIF malware Ursnif VShell Webshells WinSCP Windows 365 Windows Command Shell Zoho Assist Zoom curl phishing

Indicators of Compromise (18)

Domain

helpdesk.com itdesk.com Mallory.ai privnote.com business-data-leaks.com Law.com LOCKBIT.BLACK it.com

Email Address

jriggi@aha.org

Filename

Windows365.exe SuperOps.msi

IPv4 Address

193.141.60.212 192.236.147.131 192.236.146.173 174.169.162.62 64.94.84.97 192.236.154.158 192.236.147.138

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (1)

M1017 User Training

Exploitation (11)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +6 more

Installation (13)

M1017 User Training M1021 Restrict Web-Based Content M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +8 more

Command & Control (14)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +9 more

Actions on Objectives (16)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention +11 more

Detection Coverage

29 strategies

5/7 stages covered

Delivery (1)

DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0421 Detection Strategy for System Services S... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (7)

DET0085 Credential Dumping from SAM via Registry... DET0182 Behavior-chain detection for T1135 Netwo... DET0354 Behavior-chain detection for T1133 Exter... DET0363 Detection of Credential Dumping from LSA... DET0365 Detect Registry and Startup Folder Persi... +2 more

Command & Control (7)

DET0014 Detection of Data Staging Prior to Exfil... DET0269 Behavioral Detection Strategy for Remote... DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... DET0496 Behavior-Chain Detection for Remote Acce... +2 more

Actions on Objectives (9)

DET0215 Detection of Multi-Platform File Encrypt... DET0220 Detection of USB-Based Data Exfiltration DET0230 Detect Suspicious or Malicious Code Sign... DET0347 Detection Strategy for Masquerading via... DET0348 Detection Strategy for Exfiltration Over... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

unc3753

Type: Nation-State Active

Luna Moth Chatty Spider tracked as Silent Ransom Group legal

Infrastructure 15 IOC(s)

50%

Domain

helpdesk.com itdesk.com Mallory.ai privnote.com business-data-leaks.com +3

IPv4 Address

193.141.60.212 192.236.147.131 192.236.146.173 174.169.162.62 64.94.84.97 +2

Artifacts (3)

jriggi@aha.org Windows365.exe SuperOps.msi

Capability

50%

31 technique(s) 53 tool(s)/malware 1 CVE(s)

AnyDesk Aurora BAZARLOADER loader BRICKSTORM BazarLoader Bomgar CALENDAR Citrix Workspace/Client +45

T1070.001 T1562.001

collection

T1005 T1074

command and control

T1219 T1572

credential access

T1003.001 T1003.002

Victim

70%

Targeted Sectors

financial-services government legal-services healthcare information-technology utilities

Targeted Countries

United States of America US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.004

Capability (Malware)

AnyDesk Aurora BAZARLOADER loader

Infrastructure

helpdesk.com itdesk.com Mallory.ai

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003 T1204.002 T1569.002

Capability (Malware)

AnyDesk Aurora BAZARLOADER loader

Infrastructure

helpdesk.com itdesk.com Mallory.ai

5 Installation

Capability (Techniques)

T1003.001 T1003.002 T1046 T1083 T1135

Capability (Malware)

AnyDesk Aurora BAZARLOADER loader

Infrastructure

helpdesk.com itdesk.com Mallory.ai

6 Command & Control

Capability (Techniques)

T1005 T1074 T1219 T1572 T1021

Capability (Malware)

AnyDesk Aurora BAZARLOADER loader

Infrastructure

helpdesk.com itdesk.com Mallory.ai

7 Actions on Objectives

Capability (Techniques)

T1020 T1041 T1052.001 T1537 T1567.002

Capability (Malware)

AnyDesk Aurora BAZARLOADER loader

Infrastructure

helpdesk.com itdesk.com Mallory.ai