Kill Chain & Diamond Model Analysis
Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.
the green blood group
(threat actor)
8 techniques
51 tools/malware
3 vulnerabilities
37 IOCs
5/7 stages covered
Deepest: Actions on Objectives
›
›
›
›
›
›
7
Actions on Objectives
2
Stage risk:
Critical
High
Medium
None
Indicators of Compromise (37)
ATT&CK Tactic Coverage
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact
Recommended Mitigations
16 MITRE ATT&CK mitigations cover detected techniques
Browse all →
Detection Coverage
6 strategies
4/7 stages covered
Diamond Model of Intrusion
Adversary · Capability · Infrastructure · Victim
the green blood group
Type: Criminal Sophistication: Medium Active
tracked as
Butler Spider
Abyss
Broomstick
CleanUp
+8 more
8 technique(s) 51 tool(s)/malware 3 CVE(s)
Targeted Sectors
government
telecommunications
defense
financial-services
education
healthcare
manufacturing
critical-infrastructure
aviation
hospitality
gaming
Targeted Countries
NG
IR
KP
US
IN
EG
Diamond Model Meta-Features
Phase
Actions on Objectives
Direction
Adversary → Infrastructure → Victim
Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Activity Threads
Kill chain phase → Diamond Model event mapping