Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

l group (threat actor)

Risk

High

8 techniques 24 tools/malware 0 vulnerabilities 38 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

›

5 Installation

T1087.002

Domain Account discovery

T1518.002

Backup Software Discovery discovery

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1078.002

Domain Accounts stealth

T1134.001

Token Impersonation/Theft stealth

T1063

Stage risk: Critical High Medium None

Tools & Malware (24)

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon) Colony Conti Custom RAT Dark DoxxScan Gentlemen GitHub Global Leverage Matrix Mimikatz PHOTO PLAY Phishing campaigns Royal STOP Sarcoma Titan Unknown WMI-based persistence scripts phishing

Indicators of Compromise (38)

Domain

doclv.com JOURNAL.PMED J.BLRE J.CLIM J.IMMUNI ZII9990993520007.JPEG 2326-6066.CIR zuckers.com +22 more

Email Address

a.reinisch@medunigraz.at resultyou@email.comIllustrative verifiedyourname@email.comvalue unverifiedyourname@email.comvalue back.you@email.com support@galaxywarden.com tommaso.sconocchia@medunigraz.at

Filename

NIJCSampleAsylumWH-CATBrief.docx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (1)

M1038 Execution Prevention

Installation (1)

M1028 Operating System Configuration

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (5)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication

Detection Coverage

7 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (2)

DET0088 Backup Software Discovery via CLI, Regis... DET0129 Domain Account Enumeration Across Platfo...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (2)

DET0210 Abuse of Domain Accounts DET0482 Behavior-chain detection for T1134.001 A...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

l group

Type: Criminal Sophistication: Medium Active

et al tracked as fail-first policies step therapy protocols Ueda T +2 more

Infrastructure 30 IOC(s)

50%

Domain

doclv.com JOURNAL.PMED J.BLRE J.CLIM J.IMMUNI +25

Artifacts (8)

a.reinisch@medunigraz.at resultyou@email.comIllustrative verifiedyourname@email.comvalue unverifiedyourname@email.comvalue back.you@email.com support@galaxywarden.com +2

Capability

50%

8 technique(s) 24 tool(s)/malware

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon) Colony Conti Custom RAT Dark DoxxScan +16

T1063

command and control

T1105

discovery

T1087.002 T1518.002

execution

T1059.003

Victim

70%

Targeted Sectors

non-profit manufacturing

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon)

Infrastructure

doclv.com JOURNAL.PMED J.BLRE

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon)

Infrastructure

doclv.com JOURNAL.PMED J.BLRE

5 Installation

Capability (Techniques)

T1087.002 T1518.002

Capability (Malware)

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon)

Infrastructure

doclv.com JOURNAL.PMED J.BLRE

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Backdoor malware Breakthrough Cobalt Strike (or equivalent beacon)

Infrastructure

doclv.com JOURNAL.PMED J.BLRE