Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT16 (threat actor)

Risk

Medium

1 techniques 8 tools/malware 0 vulnerabilities 0 IOCs 1/7 stages covered Deepest: Weaponization

1 Reconnaissance

No data

›

2 Weaponization

T1584.004

Server resource development

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (8)

CVE-2015-2545 ELMER ELMER backdoor Gh0st HTRAN Pandora Poison Ivy UNICAT

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

1 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Detection Coverage

1 strategies

1/7 stages covered

Weaponization (1)

DET0874 Detection of Server

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

APT16

Type: Unknown Active

APT16 SVCMONDR G0023

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

1 technique(s) 8 tool(s)/malware

CVE-2015-2545 ELMER ELMER backdoor Gh0st HTRAN Pandora Poison Ivy UNICAT

resource development

T1584.004

Victim

70%

Targeted Sectors

government financial services media

Targeted Countries

TW JP

Diamond Model Meta-Features

Phase

Weaponization

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1584.004

Capability (Malware)

CVE-2015-2545 ELMER ELMER backdoor

Infrastructure

No infra linked