Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

? (threat actor)

Risk

High

11 techniques 55 tools/malware 0 vulnerabilities 4 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1195

Supply Chain Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1203

Exploitation for Client Execution execution

›

5 Installation

T1018

Remote System Discovery discovery

T1083

File and Directory Discovery discovery

T1538

Cloud Service Dashboard discovery

›

6 Command & Control

No data

›

7 Actions on Objectives

T1496

Resource Hijacking impact

T1498

Network Denial of Service impact

T0890

Stage risk: Critical High Medium None

Tools & Malware (55)

Agent.XST Akira Akira ransomware Anchor Aurora BRICKSTORM BRICKSTORM backdoor Backdoor malware Backdoors Cobalt Crisis Dark Emotet Empire Expand Gh0StRAT Global Grabber Guard Hydraq Keyhole Keyloggers Kivars Legitimate Software Leverage LightSpy Maggie Malwarebytes MaoCheng Dropper Matrix Micropsia NKAbuse NotPetya NotPetya ransomware Olympic Destroyer PlugX PsExec Ransomware variants Rootkit SLServer STOP SentinelOne Singularity Stuxnet Sykipot T9000 TrickMo Trojan UP007 Win32/Prikormka XMRIG XMRig Zeus Zeus Panda phishing

Indicators of Compromise (4)

Domain

running.Find TEMP.Bottle GovInfo.gov

Filename

M.E.Doc

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (12)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +7 more

Exploitation (8)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1047 Audit +3 more

Installation (1)

M1018 User Account Management

Actions on Objectives (1)

M1037 Filter Network Traffic

Detection Coverage

10 strategies

4/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (2)

DET0094 Cross-Platform Behavioral Detection of S... DET0287 Exploitation for Client Execution – cros...

Installation (3)

DET0291 Detection of Cloud Service Dashboard Usa... DET0370 Recursive Enumeration of Files and Direc... DET0574 Detection Strategy for Remote System Enu...

Actions on Objectives (2)

DET0267 Resource Hijacking Detection Strategy DET0518 Behavioral Detection of T1498 – Network...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

70%

Type: Nation-State Active

Maverick Panda PLA Navy Sykipot root access AKA +1 more

Infrastructure 3 IOC(s)

50%

Domain

running.Find TEMP.Bottle GovInfo.gov

Artifacts (1)

M.E.Doc

Capability

55%

11 technique(s) 55 tool(s)/malware

Agent.XST Akira Akira ransomware Anchor Aurora BRICKSTORM BRICKSTORM backdoor Backdoor malware +47

T0890

discovery

T1018 T1083 T1538

execution

T1053 T1203

impact

T1496 T1498

Victim

70%

Targeted Sectors

government defense critical infrastructure financial-services telecommunications critical-infrastructure aviation nuclear aerospace information-technology manufacturing transportation maritime gaming mining media oil-gas healthcare energy

Targeted Countries

TW US IR middle_east KR DE CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1195 T1566 T1566.001

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

running.Find TEMP.Bottle GovInfo.gov

4 Exploitation

Capability (Techniques)

T1053 T1203

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

running.Find TEMP.Bottle GovInfo.gov

5 Installation

Capability (Techniques)

T1018 T1083 T1538

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

running.Find TEMP.Bottle GovInfo.gov

7 Actions on Objectives

Capability (Techniques)

T1496 T1498

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

running.Find TEMP.Bottle GovInfo.gov