Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Earth Lusca (threat actor)
Risk
88
Critical
67 techniques 54 tools/malware 1 vulnerabilities 16 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1595
Active Scanning reconnaissance
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
12
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.004
Server resource development
T1583.006
Web Services resource development
T1584
Compromise Infrastructure resource development
T1584.004
Server resource development
T1584.006
Web Services resource development
T1588
Obtain Capabilities resource development
T1588.001
Malware resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
14
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.005
Visual Basic execution
T1059.006
Python execution
T1059.007
JavaScript execution
T1204
User Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2020-1472
›
5 Installation
17
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1003.006
DCSync credential access
T1007
System Service Discovery discovery
T1016
System Network Configuration Discovery discovery
T1018
Remote System Discovery discovery
T1033
System Owner/User Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1482
Domain Trust Discovery discovery
T1098
Account Manipulation persistence
T1098.004
SSH Authorized Keys persistence
T1543
Create or Modify System Process persistence
T1543.003
Windows Service persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.012
Print Processors persistence
›
6 Command & Control
4
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1090
Proxy command and control
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
14
T1112
Modify Registry defense impairment
T1567
Exfiltration Over Web Service exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1027
Obfuscated Files or Information stealth
T1027.003
Steganography stealth
T1036
Masquerading stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1218.005
Mshta stealth
T1574
Hijack Execution Flow stealth
T1574.001
DLL stealth
T1192
T1192
T1500?
T1500?
Stage risk: Critical High Medium None

Tools & Malware (54)

Akira AndroRAT Attor BIOPASS RAT Backdoors Bahamut BlackByte Buhtrap Carbanak Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 CrimsonRAT Custom Backdoor Custom backdoors Custom malware Custom tools DONOT Dark EVILNUM Ferocious Gelsemium Global Guard InvisiMole KONNI KTLVdoor Kimsuky Linux backdoor Mimikatz MuddyWater Naikon Nexus Nltest OilRig PowerShell RoundCube Sednit ShadowPad SprySOCKS StrongPity Tasklist Turla VERMIN Void WhisperGate Windows backdoor Winnti Winnti for Linux XDSpy Zebrocy megacmd phishing

Indicators of Compromise (16)

Domain
TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex file.io TEMP.hermit TEMP.Reaper +3 more
Email Address
rocke@live.cn
Filename
mshta.exe oci.dll nltest.exe spool.dll

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

36 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Installation (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +14 more
Command & Control (12)
M1016 Vulnerability Scanning M1019 Threat Intelligence Program M1020 SSL/TLS Inspection M1026 Privileged Account Management M1030 Network Segmentation +7 more
Actions on Objectives (19)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

65 strategies
7/7 stages covered

Reconnaissance (2)

DET0830 Detection of Active Scanning DET0867 Detection of Vulnerability Scanning

Weaponization (12)

DET0824 Detection of Upload Malware DET0839 Detection of Stage Capabilities DET0845 Detection of Malware DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool +7 more

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (13)

DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0094 Cross-Platform Behavioral Detection of S... DET0264 Cross-Platform Detection of JavaScript E... +8 more

Installation (17)

DET0007 Detection of Domain Trust Discovery via... DET0026 Windows Detection Strategy for T1547.012... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0096 Account Manipulation Behavior Chain Dete... +12 more

Command & Control (4)

DET0118 Exploitation of Remote Services – multi-... DET0298 Detect Archiving via Utility (T1560.001) DET0445 Detection of Proxy Infrastructure Setup... DET0526 Detect Archiving and Encryption of Colle...

Actions on Objectives (12)

DET0081 Detection of Proxy Execution via Trusted... DET0119 Detection Strategy for Steganographic Ab... DET0127 Behavioral Detection of Masquerading Acr... DET0201 Detection Strategy for Hijack Execution... DET0218 Detection Strategy for Hijack Execution... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Earth Lusca

Type: Unknown Active
TAG-22 Charcoal Typhoon CHROMIUM ControlX FISHMONGER +86 more
Infrastructure 11 IOC(s)
50%
Domain
TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +6
Artifacts (5)
rocke@live.cn mshta.exe oci.dll nltest.exe spool.dll
Capability
76%
67 technique(s) 54 tool(s)/malware 1 CVE(s)
Akira AndroRAT Attor BIOPASS RAT Backdoors Bahamut BlackByte Buhtrap +46
T1192 T1500?
collection
T1560 T1560.001
command and control
T1090
credential access
T1003 T1003.001 T1003.006
Victim
70%

Targeted Sectors

government education media telecommunications research defense financial-services non-profit healthcare energy manufacturing think-tank critical-infrastructure aerospace pharmaceutical aviation hospitality maritime transportation legal-services information-technology chemical retail gaming nuclear entertainment mining utilities oil-gas construction

Targeted Countries

CN US RU UA AE IL TW VN PK BY IN IR JP KR PL AU SA DE TR LB KZ GB FR IT SG NG IQ MX ES CA RO KP AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595 T1595.002

Capability (Malware)

Akira AndroRAT Attor
2 Weaponization

Capability (Malware)

Akira AndroRAT Attor
3 Delivery

Capability (Malware)

Akira AndroRAT Attor
4 Exploitation

Capability (Malware)

Akira AndroRAT Attor
5 Installation

Capability (Malware)

Akira AndroRAT Attor
6 Command & Control

Capability (Malware)

Akira AndroRAT Attor
7 Actions on Objectives

Capability (Techniques)

T1567 T1567.002

Capability (Malware)

Akira AndroRAT Attor
Leaving Threaticon

This link opens an external site that isn't part of the platform.