Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-2945 (threat actor)

Risk

Critical

40 techniques 41 tools/malware 15 vulnerabilities 37 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1591

Gather Victim Org Information reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1106

Native API execution

T1203

Exploitation for Client Execution execution

T1548

Abuse Elevation Control Mechanism privilege escalation

CVE CVE-2021-26855

CVE CVE-2021-34523

CVE CVE-2022-38028

CVE CVE-2022-41040

CVE CVE-2022-41082

CVE CVE-2023-22518

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-30622

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-63077

›

5 Installation

T1010

Application Window Discovery discovery

T1046

Network Service Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1680

Local Storage Discovery discovery

T1098

Account Manipulation persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1560

Archive Collected Data collection

T1008

Fallback Channels command and control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1104

Multi-Stage Channels command and control

T1105

Ingress Tool Transfer command and control

T1571

Non-Standard Port command and control

T1534

Internal Spearphishing lateral movement

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1490

Inhibit System Recovery impact

T1499

Endpoint Denial of Service impact

T1027

Obfuscated Files or Information stealth

T1070

Indicator Removal stealth

T1078

Valid Accounts stealth

T1134

Access Token Manipulation stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1202

Indirect Command Execution stealth

T1497

Virtualization/Sandbox Evasion stealth

T1574

Hijack Execution Flow stealth

T1622

Debugger Evasion stealth

Stage risk: Critical High Medium None

Tools & Malware (41)

BITS Backdoors ChocoShell ClickFix Conti CornFlake Custom malware Dark Device code phishing Expand Firefox FrostyGoop FunnyDream Gentlemen GitHub Global Group Policy Gunra Hook Infostealer Interception KryBit Leverage Microsoft Defender XDR Microsoft Teams Nexus Payload Payload Phishing campaigns Pikabot PowerShell Rundll32 Scheduled Tasks SolarWinds Triton VBScript Windows Command Shell inter netsh phishing systemd

Indicators of Compromise (37)

Domain

TEMP.Veles cookies.sqlite sync.dat pixel.gif Network.getAllCookies abuse.Microsoft msftconnecttest.com msftncsi.com +11 more

Filename

cmd.exe rundll32.exe svchost.exe spoolsv.exe mshta.exe user32.dll mpnotify.exe svchost32.exe +9 more

IPv4 Address

213.145.86.112

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1048 Application Isolation and Sandboxing +3 more

Exploitation (14)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +9 more

Installation (11)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +6 more

Command & Control (5)

M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit M1057 Data Loss Prevention

Actions on Objectives (26)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +21 more

Detection Coverage

40 strategies

6/7 stages covered

Reconnaissance (1)

DET0890 Detection of Gather Victim Org Informati...

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (4)

DET0287 Exploitation for Client Execution – cros... DET0345 Detection Strategy for Abuse Elevation C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0529 Behavioral Detection of Native API Invoc...

Installation (9)

DET0034 Detection of Adversarial Process Discove... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0188 Local Storage Discovery via Drive Enumer... DET0365 Detect Registry and Startup Folder Persi... +4 more

Command & Control (9)

DET0027 Detection of Web Protocol-Based C2 Over... DET0054 Internal Spearphishing via Trusted Accou... DET0060 Detect Ingress Tool Transfers via Behavi... DET0227 Detection Strategy for Non-Standard Port... DET0228 Detect Multi-Stage Command and Control C... +4 more

Actions on Objectives (15)

DET0046 Detection Strategy for T1497 Virtualizat... DET0146 Detection of Data Destruction Across Pla... DET0184 Behavioral Detection of Indicator Remova... DET0200 Indirect Command Execution – Windows uti... DET0208 Endpoint Resource Saturation and Crash P... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-2945

Type: Unknown Active

APT29 Cozy Bear tracked as the Dukes Nobelium +26 more

Infrastructure 20 IOC(s)

50%

Domain

TEMP.Veles cookies.sqlite sync.dat pixel.gif Network.getAllCookies +14

IPv4 Address

213.145.86.112

Artifacts (17)

cmd.exe rundll32.exe svchost.exe spoolsv.exe mshta.exe user32.dll +11

Capability

50%

40 technique(s) 41 tool(s)/malware 15 CVE(s)

BITS Backdoors ChocoShell ClickFix Conti CornFlake Custom malware Dark +33

collection

T1005 T1560

command and control

T1008 T1071 T1071.001 T1104 +2

defense impairment

T1685

discovery

T1010 T1046 T1057 T1082 +2

Victim

70%

Targeted Sectors

financial-services hospitality government defense energy healthcare media telecommunications manufacturing information-technology construction critical-infrastructure transportation education non-profit chemical aerospace maritime aviation think-tank utilities oil-gas nuclear legal-services entertainment

Targeted Countries

US RU CN UA IN IR JP AU KR GB DE PL CA VN FR BR SG TW ES KZ IL TR MX IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1591

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat

3 Delivery

Capability (Techniques)

T1189 T1566.002

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat

4 Exploitation

Capability (Techniques)

T1059.001 T1106 T1203 T1548

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat

5 Installation

Capability (Techniques)

T1010 T1046 T1057 T1082 T1083

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat

6 Command & Control

Capability (Techniques)

T1005 T1560 T1008 T1071 T1071.001

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat

7 Actions on Objectives

Capability (Techniques)

T1041 T1485 T1486 T1490 T1499

Capability (Malware)

BITS Backdoors ChocoShell

Infrastructure

TEMP.Veles cookies.sqlite sync.dat