Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

montage (threat actor)

Risk

Critical

26 techniques 40 tools/malware 0 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1591.002

Business Relationships reconnaissance

T1591.004

Identify Roles reconnaissance

T1592.001

Hardware reconnaissance

›

2 Weaponization

T1587.001

Malware resource development

T1587.004

Exploits resource development

T1588.002

Tool resource development

T1588.005

Exploits resource development

T1588.006

Vulnerabilities resource development

T1588.007

Artificial Intelligence resource development

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

T1090.003

Multi-hop Proxy command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1027.014

Polymorphic Code stealth

T1027.016

Junk Code Insertion stealth

T0008.000

T0008.005

T0010.001

T0016.001

T0016.002

T0021

T0040

T0054

T0072

T0088

T0102

T0103

Stage risk: Critical High Medium None

Tools & Malware (40)

BRICKSTORM Backdoor malware Backdoors Dark Emotet Gemini GitHub Global Guard Legitimate Software Leverage MESHAGENT Malware Malwarebytes Matrix Microsoft Defender XDR Microsoft Teams Nexus PHOTO Payload Payload Phishing campaigns Play PowerShell PowerShell commands Rogue Rootkit STOP ScreenConnect ScreenConnect client Signal Tactical RMM Trojan Trojans Unknown Volt Typhoon Zero-day exploits Zoom phishing phishing emails

Indicators of Compromise (40)

Domain

eliteautoused-cars.com httpecured.im sherwoods.ae lankystocks.com chata2go.com.mx easyguidepdf.com r2.dev waynelimck.com +5 more

Filename

msiexec.exe services.exe Montage-clean.docx msteams.exe trustconnectagent.exe adobereader.exe zoomworkspace.clientsetup.exe invite.exe +3 more

MD5 Hash

575e7adf57f741ba8ce32bfe83a1e7f4

SHA-256 Hash

35f03708f590810be88dfb27c53d63cd6bb3fb93c110ca0d01bc23ecdf61f983 af651ebcacd88d292eb2b6cbbe28b1e0afd1d418be862d9e34eacbd65337398c c862dbcada4472e55f8d1ffc3d5cfee65d1d5e06b59a724e4a93c7099dd37357 c6097dfbdaf256d07ffe05b443f096c6c10d558ed36380baf6ab446e6f5e2bc3 ef7702ac5f574b2c046df6d5ab3e603abe57d981918cddedf4de6fe41b1d3288 edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0 9827c2d623d2e3af840b04d5102ca5e4bd01af174131fc00731b0764878f00ca 98a4d09db3de140d251ea6afd30dcf3a08e8ae8e102fc44dd16c4356cc7ad8a6 +7 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Command & Control (1)

M1037 Filter Network Traffic

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1049 Antivirus/Antimalware M1057 Data Loss Prevention

Detection Coverage

14 strategies

5/7 stages covered

Reconnaissance (3)

DET0807 Detection of Identify Roles DET0855 Detection of Business Relationships DET0887 Detection of Hardware

Weaponization (6)

DET0808 Detection of Vulnerabilities DET0827 Detection of Exploits DET0842 Detection of Artificial Intelligence DET0852 Detection of Tool DET0872 Detection of Malware +1 more

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Command & Control (1)

DET0359 Multi-hop Proxy Behavior via Relay Node...

Actions on Objectives (3)

DET0322 Detection Strategy for Junk Code Obfusca... DET0324 Detection Strategy for Polymorphic Code... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

montage

Type: Criminal Sophistication: Medium Active

root access UNC6780 Bob is an American Youtuber LordMinion777 +2 more

Infrastructure 13 IOC(s)

50%

Domain

eliteautoused-cars.com httpecured.im sherwoods.ae lankystocks.com chata2go.com.mx +8

Artifacts (27)

msiexec.exe services.exe Montage-clean.docx msteams.exe trustconnectagent.exe adobereader.exe +21

Capability

50%

26 technique(s) 40 tool(s)/malware

BRICKSTORM Backdoor malware Backdoors Dark Emotet Gemini GitHub Global +32

T0008.000 T0008.005 T0010.001 T0016.001 +8

command and control

T1090.003

exfiltration

T1041

initial access

T1566

Victim

70%

Targeted Sectors

financial-services government media critical-infrastructure defense hospitality telecommunications aviation transportation manufacturing healthcare energy utilities information-technology

Targeted Countries

CN US RU IT IR PL IL MX CA UA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1591.002 T1591.004 T1592.001

Capability (Malware)

BRICKSTORM Backdoor malware Backdoors

Infrastructure

eliteautoused-cars.com httpecured.im sherwoods.ae

2 Weaponization

Capability (Techniques)

T1587.001 T1587.004 T1588.002 T1588.005 T1588.006

Capability (Malware)

BRICKSTORM Backdoor malware Backdoors

Infrastructure

eliteautoused-cars.com httpecured.im sherwoods.ae

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

BRICKSTORM Backdoor malware Backdoors

Infrastructure

eliteautoused-cars.com httpecured.im sherwoods.ae

6 Command & Control

Capability (Techniques)

T1090.003

Capability (Malware)

BRICKSTORM Backdoor malware Backdoors

Infrastructure

eliteautoused-cars.com httpecured.im sherwoods.ae

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

BRICKSTORM Backdoor malware Backdoors

Infrastructure

eliteautoused-cars.com httpecured.im sherwoods.ae