Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT29 (threat actor)
Risk
100
Critical
97 techniques 67 tools/malware 8 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1595
Active Scanning reconnaissance
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
10
T1583
Acquire Infrastructure resource development
T1583.006
Web Services resource development
T1584
Compromise Infrastructure resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1586.003
Cloud Accounts resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1587.003
Digital Certificates resource development
T1588.002
Tool resource development
›
3 Delivery
6
T1190
Exploit Public-Facing Application initial access
T1199
Trusted Relationship initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
T1566.003
Spearphishing via Service initial access
›
4 Exploitation
24
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.006
Python execution
T1059.009
Cloud API execution
T1203
Exploitation for Client Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1651
Cloud Administration Command execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1546.003
Windows Management Instrumentation Event Subscription privilege escalation
T1546.008
Accessibility Features privilege escalation
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2013-0640
CVE CVE-2018-13379
CVE CVE-2019-11510
CVE CVE-2019-19781
CVE CVE-2019-9670
CVE CVE-2020-0688
CVE CVE-2021-36934
CVE CVE-2023-38831
›
5 Installation
29
T1003.002
Security Account Manager credential access
T1003.004
LSA Secrets credential access
T1110
Brute Force credential access
T1110.001
Password Guessing credential access
T1110.003
Password Spraying credential access
T1528
Steal Application Access Token credential access
T1555
Credentials from Password Stores credential access
T1558
Steal or Forge Kerberos Tickets credential access
T1621
Multi-Factor Authentication Request Generation credential access
T1649
Steal or Forge Authentication Certificates credential access
T1016
System Network Configuration Discovery discovery
T1016.001
Internet Connection Discovery discovery
T1057
Process Discovery discovery
T1069
Permission Groups Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1087.004
Cloud Account discovery
T1482
Domain Trust Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1037.004
RC Scripts persistence
T1098
Account Manipulation persistence
T1098.002
Additional Email Delegate Permissions persistence
T1098.005
Device Registration persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1136.003
Cloud Account persistence
T1505.003
Web Shell persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
18
T1005
Data from Local System collection
T1074
Data Staged collection
T1114.002
Remote Email Collection collection
T1213
Data from Information Repositories collection
T1560
Archive Collected Data collection
T1001
Data Obfuscation command and control
T1071
Application Layer Protocol command and control
T1090
Proxy command and control
T1090.002
External Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1090.004
Domain Fronting command and control
T1102
Web Service command and control
T1105
Ingress Tool Transfer command and control
T1568
Dynamic Resolution command and control
T1573
Encrypted Channel command and control
T1665
Hide Infrastructure command and control
T1021.007
Cloud Services lateral movement
T1550.003
Pass the Ticket lateral movement
›
7 Actions on Objectives
16
T1553.005
Mark-of-the-Web Bypass defense impairment
T1556.007
Hybrid Identity defense impairment
T1685.002
Disable or Modify Cloud Log defense impairment
T1027
Obfuscated Files or Information stealth
T1027.001
Binary Padding stealth
T1027.002
Software Packing stealth
T1027.006
HTML Smuggling stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070
Indicator Removal stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078
Valid Accounts stealth
T1078.003
Local Accounts stealth
T1078.004
Cloud Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218.005
Mshta stealth
Stage risk: Critical High Medium None

Tools & Malware (67)

ATI-Agent AdFind AdobeARM BEATDROP Backdoors Beacon BoomBox COZYDUKE CloudDuke Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 CosmicDuke CozyCar Dark EnvyScout FatDuke FoggyWeb GeminiDuke Global GoldFinder GoldMax Grizzly Steppe Group Policy HAMMERTOSS Hammertoss LiteDuke MiniDionis MiniDuke NativeZone OnionDuke POSHSPY Payload Payload Phishing campaigns Phishing emails PinchDuke PolyglotDuke PowerDuke PowerShell QUIETEXIT Raindrop RegDuke Rundll32 SUNBURST SUNSPOT SeaDaddy implant developed in Python and compiled with py2exe SeaDuke Sibot SolarWinds SoreFang Spear-phishing Spear-phishing Campaigns Spikerush TEARDROP Tadpole TrailBlazer VaporRage Vernaldrop WINELOADER WellMail WellMess Windows Command Shell phishing reGeorg rundll32.exe

Indicators of Compromise (40)

Domain
updates.This header.An TEMP.Monkeys Mail.Read Trojan.Cozer diplomacy.pl Zone.Identifier Covid.html +2 more
Email Address
intelreports@kaspersky.com
Filename
imageres.dll trello.dll cmd.exe rundll32.exe Version.dll ntdll.dll Rundll32.exe version.dll +7 more
MD5 Hash
da24b2783758ff5ccc2d0f5ebcc2a218 363a95777f401df40db61148593ea387 e031c9984f65a9060ec1e70fbb84746b 2f712cdae87cdb7ccc0f4046ffa3281d 4ae0b6be7f38e2eb84b881abf5110edc 628799f1f8146038b488c9ed06799b93 6ac740ebf98df7217d31cb826a207af6 a0b4e7622728c317f37ae354b8bc3dbb +1 more
SHA-256 Hash
207132befb085f413480f8af9fdd690ddf5b9d21a9ea0d4a4e75f34f023ad95d 8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca 538d896cf066796d8546a587deea385db9e285f1a7ebf7dcddae22f8d61a2723 2f11ca3dcc1d9400e141d8f3ee9a7a0d18e21908e825990f5c22119214fbb2f5 a896c2d16cadcdedd10390c3af3399361914db57bde1673e46180244e806a1d0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (16)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more
Exploitation (20)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more
Installation (18)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more
Command & Control (15)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content +10 more
Actions on Objectives (18)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +13 more

Detection Coverage

97 strategies
7/7 stages covered

Reconnaissance (2)

DET0830 Detection of Active Scanning DET0867 Detection of Vulnerability Scanning

Weaponization (10)

DET0844 Detection of Digital Certificates DET0852 Detection of Tool DET0853 Detection of Develop Capabilities DET0861 Detection of Email Accounts DET0872 Detection of Malware +5 more

Delivery (6)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att... +1 more

Exploitation (16)

DET0033 Detection Strategy for Accessibility Fea... DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0078 Behavioral Detection of Malicious Cloud... DET0086 Detect WMI Event Subscription for Persis... +11 more

Installation (29)

DET0007 Detection of Domain Trust Discovery via... DET0034 Detection of Adversarial Process Discove... DET0036 Suspicious Device Registration via Entra... DET0085 Credential Dumping from SAM via Registry... DET0096 Account Manipulation Behavior Chain Dete... +24 more

Command & Control (18)

DET0008 Behavioral Detection of Remote Cloud Log... DET0014 Detection of Data Staging Prior to Exfil... DET0039 Detection Strategy for Dynamic Resolutio... DET0048 Detect Remote Email Collection via Abnor... DET0053 Detect Obfuscated C2 via Network Traffic... +13 more

Actions on Objectives (16)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0140 Behavioral Detection of Malicious File D... DET0184 Behavioral Detection of Indicator Remova... DET0257 Detect Mark-of-the-Web (MOTW) Bypass via... DET0275 Detect Adversary Deobfuscation or Decodi... +11 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
70%

APT29

Type: Nation-State Active
Dukes Group 100 Cozy Duke EuroAPT Cozy Bear +39 more
Infrastructure 10 IOC(s)
50%
Domain
updates.This header.An TEMP.Monkeys Mail.Read Trojan.Cozer +5
Artifacts (30)
intelreports@kaspersky.com imageres.dll trello.dll cmd.exe rundll32.exe Version.dll +24
Capability
77%
97 technique(s) 67 tool(s)/malware 8 CVE(s)
ATI-Agent AdFind AdobeARM BEATDROP Backdoors Beacon BoomBox COZYDUKE +59
collection
T1005 T1074 T1114.002 T1213 +1
command and control
T1001 T1071 T1090 T1090.002 +7
credential access
T1003.002 T1003.004 T1110 T1110.001 +6
defense impairment
T1553.005 T1556.007 T1685.002
Victim
70%

Targeted Sectors

government think-tank defense non-profit energy healthcare telecommunications media pharmaceutical education aviation maritime aerospace financial-services transportation utilities

Targeted Countries

middle_east europe central_asia RU US GB UA NL CA KR DE

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595 T1595.002

Capability (Malware)

ATI-Agent AdFind AdobeARM
2 Weaponization

Capability (Malware)

ATI-Agent AdFind AdobeARM
3 Delivery

Capability (Malware)

ATI-Agent AdFind AdobeARM
4 Exploitation

Capability (Malware)

ATI-Agent AdFind AdobeARM
5 Installation

Capability (Malware)

ATI-Agent AdFind AdobeARM
6 Command & Control

Capability (Malware)

ATI-Agent AdFind AdobeARM
Leaving Threaticon

This link opens an external site that isn't part of the platform.