Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT33 (threat actor)

Risk

Critical

53 techniques 54 tools/malware 3 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588

Obtain Capabilities resource development

T1588.002

Tool resource development

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

T1203

Exploitation for Client Execution execution

T1204

User Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1546

Event Triggered Execution privilege escalation

T1546.003

Windows Management Instrumentation Event Subscription privilege escalation

CVE CVE-2017-0213

CVE CVE-2017-11774

CVE CVE-2018-20250

›

5 Installation

T1003

OS Credential Dumping credential access

T1003.001

LSASS Memory credential access

T1003.004

LSA Secrets credential access

T1003.005

Cached Domain Credentials credential access

T1040

Network Sniffing credential access

T1110

Brute Force credential access

T1110.003

Password Spraying credential access

T1552

Unsecured Credentials credential access

T1552.001

Credentials In Files credential access

T1552.006

Group Policy Preferences credential access

T1555

Credentials from Password Stores credential access

T1555.003

Credentials from Web Browsers credential access

T1082

System Information Discovery discovery

T1547

Boot or Logon Autostart Execution persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1113

Screen Capture collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1132

Data Encoding command and control

T1132.001

Standard Encoding command and control

T1571

Non-Standard Port command and control

T1573

Encrypted Channel command and control

T1573.001

Symmetric Cryptography command and control

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol exfiltration

T1027

Obfuscated Files or Information stealth

T1027.013

Encrypted/Encoded File stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T0852

T0853

T0865

Stage risk: Critical High Medium None

Tools & Malware (54)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor Backdoors Cobalt Custom malware DEADWOOD DROPSHOT DarkComet Destructive Malware DistTrack Empire GlassWorm Global Gpppassword Group Policy Guard HTA files Interception LaZagne Medusa Mimikatz MuddyWater NETWIRE NanoCore POWERTON Phishing campaigns Phishing emails Phishing kits Poseidon PoshC2 PowerShell PowerShell scripts PowerSploit Ruler SHAPESHIFT STOP SentinelOne Shamoon SniffPass Spear Phishing Campaigns Spear-phishing StoneDrill TURNEDUP Trojan Unknown Windows Command Shell Winrar XAgent Zero-day exploits Zero‑day exploits phishing proc dump procdump

Indicators of Compromise (39)

Domain

NJ.gov boeing.servehttp.com alsalam.ddns.net ngaaksa.ddns.net ngaaksa.sytes.net vinnellarabia.myftp.org Trojan.Stonedrill weekend.Iran +10 more

Email Address

solevisible@gmail.com

MD5 Hash

b3d73364995815d78f6d66101e718837 de7a44518d67b13cda535474ffedf36b 3f5329cf2a829f8840ba6a903f17a1bf 10f58774cd52f71cd4438547c39b1aa7 663c18cfcedd90a3c91a09478f1e91bc 6f1d5c57b3b415edc3767b079999dd50 0ccc9ec82f1d44c243329014b82d3125 fb21f3cea1aa051ba2a45e75d46b98b8 +12 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Installation (19)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Command & Control (5)

M1020 SSL/TLS Inspection M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit

Actions on Objectives (16)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +11 more

Detection Coverage

50 strategies

6/7 stages covered

Weaponization (2)

DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (12)

DET0010 Behavioral Detection of Event Triggered... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0086 Detect WMI Event Subscription for Persis... DET0094 Cross-Platform Behavioral Detection of S... +7 more

Installation (15)

DET0037 Detect Suspicious Access to Browser Cred... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0307 Detect Access to Unsecured Credential Fi... DET0314 Detection Strategy for Network Sniffing... +10 more

Command & Control (11)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0108 Detection Strategy for Data Encoding in... DET0124 Behavior-chain detection for T1132.001 D... DET0143 Detection Strategy for Encrypted Channel... +6 more

Actions on Objectives (7)

DET0087 Encrypted or Encoded File Payload Detect... DET0131 Behavioral Detection Strategy for Exfilt... DET0149 Detection of Exfiltration Over Unencrypt... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

APT33

Type: Unknown Active

HOLMIUM Elfin Peach Sandstorm APT 33 MAGNALLIUM +9 more

Infrastructure 18 IOC(s)

50%

Domain

NJ.gov boeing.servehttp.com alsalam.ddns.net ngaaksa.ddns.net ngaaksa.sytes.net +13

Artifacts (21)

solevisible@gmail.com b3d73364995815d78f6d66101e718837 de7a44518d67b13cda535474ffedf36b 3f5329cf2a829f8840ba6a903f17a1bf 10f58774cd52f71cd4438547c39b1aa7 663c18cfcedd90a3c91a09478f1e91bc +15

Capability

73%

53 technique(s) 54 tool(s)/malware 3 CVE(s)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor Backdoors Cobalt Custom malware DEADWOOD DROPSHOT +46

T0852 T0853 T0865

collection

T1113 T1560 T1560.001

command and control

T1071 T1071.001 T1105 T1132 +4

credential access

T1003 T1003.001 T1003.004 T1003.005 +8

Victim

70%

Targeted Sectors

energy aerospace defense government aviation financial-services telecommunications oil-gas transportation non-profit healthcare education manufacturing media

Targeted Countries

SA IR US KR IL CN AE

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588 T1588.002

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net

3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net

4 Exploitation

Capability (Techniques)

T1053 T1053.005 T1059 T1059.001 T1059.005

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net

5 Installation

Capability (Techniques)

T1003 T1003.001 T1003.004 T1003.005 T1040

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net

6 Command & Control

Capability (Techniques)

T1113 T1560 T1560.001 T1071 T1071.001

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net

7 Actions on Objectives

Capability (Techniques)

T1048 T1048.003

Capability (Malware)

ADVSTORESHELL ALFA TEaM Shell AutoIt backdoor

Infrastructure

NJ.gov boeing.servehttp.com alsalam.ddns.net