Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SilverTerrier (threat actor)

Risk

Medium

4 techniques 12 tools/malware 0 vulnerabilities 0 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1071.002

File Transfer Protocols command and control

T1071.003

Mail Protocols command and control

›

7 Actions on Objectives

T1657

Financial Theft impact

Stage risk: Critical High Medium None

Tools & Malware (12)

Agent Tesla DarkComet DarkComet and NanoCore ISR Stealer ISpySoftware KeyBase Lokibot NETWIRE NanoCore Pony Predator Pain Zeus and Atmos

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

4 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1017 User Training M1018 User Account Management

Detection Coverage

4 strategies

2/7 stages covered

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0416 Detection of File Transfer Protocol-Base...

Actions on Objectives (1)

DET0495 Detection Strategy for Financial Theft

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

SilverTerrier

Type: Unknown Active

Nigeria

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

4 technique(s) 12 tool(s)/malware

Agent Tesla DarkComet DarkComet and NanoCore ISR Stealer ISpySoftware KeyBase Lokibot NETWIRE +4

command and control

T1071.001 T1071.002 T1071.003

impact

T1657

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1071.001 T1071.002 T1071.003

Capability (Malware)

Agent Tesla DarkComet DarkComet and NanoCore

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1657

Capability (Malware)

Agent Tesla DarkComet DarkComet and NanoCore

Infrastructure

No infra linked