Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Saint Bear (threat actor)
Risk
91
Critical
33 techniques 50 tools/malware 2 vulnerabilities 14 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589
Gather Victim Identity Information reconnaissance
T1589.002
Email Addresses reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1583.006
Web Services resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
11
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.007
JavaScript execution
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
CVE CVE-2017-11882
CVE CVE-2018-0171
›
5 Installation
2
T1098
Account Manipulation persistence
T1505.003
Web Shell persistence
›
6 Command & Control
1
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
11
T1112
Modify Registry defense impairment
T1553
Subvert Trust Controls defense impairment
T1553.002
Code Signing defense impairment
T1685
Disable or Modify Tools defense impairment
T1027
Obfuscated Files or Information stealth
T1027.002
Software Packing stealth
T1027.013
Encrypted/Encoded File stealth
T1497
Virtualization/Sandbox Evasion stealth
T1684
Social Engineering stealth
T1684.001
Impersonation stealth
T1562.006
T1562.006
Stage risk: Critical High Medium None

Tools & Malware (50)

APT38 Akira AppleJeus Backdoors BlackByte CVE-2017-11882 Carbanak Cobalt Confucius Custom malware Dark DarkHotel Discord CDN (file hosting) Global Guard Hafnium Karma Kimsuky Machete Malicious Office Document with Embedded JavaScript Object Medusa MuddyWater Naikon Nexus Octopus OilRig Open-source tools OutSteel PLAY Payload PlugX Poseidon PowerShell RedCurl Remote access tools STOP Saint Bot Sakula SideWinder TeamTNT Trojan Turla Unknown Void WhisperGate Windows Command Shell Winnti Wiper malware Zero-day exploits phishing

Indicators of Compromise (14)

Domain
basicsecurity.net TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex Mallory.ai TEMP.hermit TEMP.Reaper +5 more
Email Address
rocke@live.cn

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +11 more
Installation (7)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +2 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (14)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +9 more

Detection Coverage

32 strategies
7/7 stages covered

Reconnaissance (2)

DET0814 Detection of Email Addresses DET0841 Detection of Gather Victim Identity Info...

Weaponization (4)

DET0824 Detection of Upload Malware DET0839 Detection of Stage Capabilities DET0895 Detection of Acquire Infrastructure DET0896 Detection of Web Services

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (9)

DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +4 more

Installation (2)

DET0096 Account Manipulation Behavior Chain Dete... DET0394 Web Shell Detection via Server Behavior...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (10)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0046 Detection Strategy for T1497 Virtualizat... DET0087 Encrypted or Encoded File Payload Detect... DET0230 Detect Suspicious or Malicious Code Sign... DET0280 Behavior-Based Registry Modification Det... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Saint Bear

Type: Unknown Active
Storm-0587 TA471 UAC-0056 Lorec53 UNC2589 +22 more
Infrastructure 13 IOC(s)
50%
Domain
basicsecurity.net TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +8
Artifacts (1)
rocke@live.cn
Capability
72%
33 technique(s) 50 tool(s)/malware 2 CVE(s)
APT38 Akira AppleJeus Backdoors BlackByte CVE-2017-11882 Carbanak Cobalt +42
T1562.006
command and control
T1071
defense impairment
T1112 T1553 T1553.002 T1685
execution
T1053.005 T1059 T1059.001 T1059.003 +5
Victim
70%

Targeted Sectors

government defense financial-services telecommunications healthcare education manufacturing non-profit energy media critical-infrastructure pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services nuclear entertainment oil-gas maritime construction utilities

Targeted Countries

CN UA US RU IR VN JP IL GB AU SA PK TW AE SG KR IN DE BY TR MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1589.002

Capability (Malware)

APT38 Akira AppleJeus
2 Weaponization

Capability (Malware)

APT38 Akira AppleJeus
3 Delivery

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Techniques)

T1098 T1505.003

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.