Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

clicklock dev (threat actor)
Risk
84
Critical
70 techniques 34 tools/malware 1 vulnerabilities 37 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
2 Weaponization
7
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
T1608.001
Upload Malware resource development
T1608.002
Upload Tool resource development
3 Delivery
3
T1566
Phishing initial access
T1566.001
T1566.002
Spearphishing Link initial access
4 Exploitation
8
T1059.002
AppleScript execution
T1059.003
T1059.004
Unix Shell execution
T1204
T1204.001
T1204.004
5 Installation
20
T1187
Forced Authentication credential access
T1539
Steal Web Session Cookie credential access
T1552
Unsecured Credentials credential access
T1552.001
Credentials In Files credential access
T1552.003
Shell History credential access
T1555
T1555.001
Keychain credential access
T1555.003
T1555.005
Password Managers credential access
T1057
T1087
T1087.001
Local Account discovery
T1518
T1543.001
Launch Agent persistence
T1547.003
Time Providers persistence
6 Command & Control
14
T1005
T1056
Input Capture collection
T1056.002
T1074
Data Staged collection
T1119
T1560
T1560.001
T1560.002
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1102
Web Service command and control
T1102.003
One-Way Communication command and control
T1105
Ingress Tool Transfer command and control
7 Actions on Objectives
19
T1020
T1030
T1567.002
T1489
T1027.016
T1036
T1036.008
T1070
T1070.004
T1070.006
Timestomp stealth
T1070.009
T1078
T1564
T1564.003
Stage risk: Critical High Medium None

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

70 strategies
6/7 stages covered

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization
3 Delivery

Capability (Techniques)

Capability (Malware)

4 Exploitation
5 Installation
6 Command & Control

Capability (Malware)

7 Actions on Objectives

Capability (Malware)

Leaving Threaticon

This link opens an external site that isn't part of the platform.