Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Sidewinder (threat actor)

Risk

Critical

47 techniques 53 tools/malware 5 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1598

Phishing for Information reconnaissance

T1598.002

Spearphishing Attachment reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

T1059.007

JavaScript execution

T1203

Exploitation for Client Execution execution

T1204

User Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1559

Inter-Process Communication execution

T1559.002

Dynamic Data Exchange execution

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2019-2215

CVE CVE-2020-0674

CVE CVE-2023-3519

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1033

System Owner/User Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1124

System Time Discovery discovery

T1518

Software Discovery discovery

T1518.001

Security Software Discovery discovery

T1547

Boot or Logon Autostart Execution persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1074

Data Staged collection

T1074.001

Local Data Staging collection

T1119

Automated Collection collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1027.010

Command Obfuscation stealth

T1027.013

Encrypted/Encoded File stealth

T1036

Masquerading stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055

Process Injection stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218

System Binary Proxy Execution stealth

T1218.005

Mshta stealth

T1564

Hide Artifacts stealth

T1574

Hijack Execution Flow stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (53)

Akira Beacon CVE-2017-11882 Carbon Cobalt Cobalt Strike Cobalt Strike BEACON DDRA.exe Dark Device code phishing Explorer FileFix FinFisher Global GoSerpent Koadic LNK files Leverage MSBuild Malicious Office documents Malicious files Mirage Mirage Kitten Nexus OneDrive.exe PLAY Payload Payload Phishing campaigns PowerShell ReverseRAT RtlAudioDriver.exe Rundll32 STOP SentinelOne SideWinder Snake Snitch.exe Spear-phishing Spear-phishing emails StealerBot Unknown VBScript WarHawk WarHawk backdoor Windows Command Shell YARA curl inter msbuild.exe mshta phishing whoami

Indicators of Compromise (40)

Domain

customs-lk.org fia-gov.org cabinet.gov.pk cisa.gov nepra.org.pk glass.php Hunt.io cybergeist.io +9 more

Filename

33-Advisory-No-33-2022.pdf NTDLL.dll stage2.exe mshta.exe notepad.exe MsBuild.exe OneDrive.exe DDRA.exe +11 more

MD5 Hash

d510808a743e6afc705fc648ca7f896a 63d6d8213d9cc070b2a3dfd3c5866564

IPv4 Address

3.239.29.103 146.190.235.137

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1017 User Training M1054 Software Configuration

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (16)

M1013 Application Developer Guidance M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +11 more

Command & Control (4)

M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (21)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +16 more

Detection Coverage

47 strategies

6/7 stages covered

Reconnaissance (3)

DET0823 Detection of Phishing for Information DET0865 Detection of Spearphishing Attachment DET0878 Detection of Spearphishing Link

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (10)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +5 more

Installation (10)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0151 Behavior-chain, platform-aware detection... DET0195 Behavioral Detection of System Network C... +5 more

Command & Control (6)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect... DET0261 Detection of Local Data Staging Prior to... +1 more

Actions on Objectives (14)

DET0081 Detection of Proxy Execution via Trusted... DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0201 Detection Strategy for Hijack Execution... DET0218 Detection Strategy for Hijack Execution... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Sidewinder

Type: Unknown Active

T-APT-04 Rattlesnake India SideWinder APT-C-17 +14 more

Infrastructure 19 IOC(s)

50%

Domain

customs-lk.org fia-gov.org cabinet.gov.pk cisa.gov nepra.org.pk +12

IPv4 Address

3.239.29.103 146.190.235.137

Artifacts (21)

33-Advisory-No-33-2022.pdf NTDLL.dll stage2.exe mshta.exe notepad.exe MsBuild.exe +15

Capability

76%

47 technique(s) 53 tool(s)/malware 5 CVE(s)

Akira Beacon CVE-2017-11882 Carbon Cobalt Cobalt Strike Cobalt Strike BEACON DDRA.exe +45

collection

T1074 T1074.001 T1119

command and control

T1071 T1071.001 T1105

discovery

T1016 T1033 T1057 T1082 +4

execution

T1059 T1059.001 T1059.005 T1059.007 +6

Victim

70%

Targeted Sectors

defense government maritime nuclear transportation healthcare critical-infrastructure hospitality financial-services manufacturing education

Targeted Countries

PK IN CN US TR SY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1598 T1598.002 T1598.003

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk

3 Delivery

Capability (Techniques)

T1190 T1566 T1566.001 T1566.002

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1059.005 T1059.007 T1203

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk

5 Installation

Capability (Techniques)

T1016 T1033 T1057 T1082 T1083

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk

6 Command & Control

Capability (Techniques)

T1074 T1074.001 T1119 T1071 T1071.001

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk

7 Actions on Objectives

Capability (Techniques)

T1020 T1041

Capability (Malware)

Akira Beacon CVE-2017-11882

Infrastructure

customs-lk.org fia-gov.org cabinet.gov.pk