Kill Chain & Diamond Model Analysis
Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.
cl0p
(threat actor)
2 techniques
40 tools/malware
15 vulnerabilities
40 IOCs
2/7 stages covered
Deepest: Exploitation
Stage risk:
Critical
High
Medium
None
Indicators of Compromise (40)
ATT&CK Tactic Coverage
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact
Recommended Mitigations
14 MITRE ATT&CK mitigations cover detected techniques
Browse all →
Detection Coverage
2 strategies
1/7 stages covered
Diamond Model of Intrusion
Adversary · Capability · Infrastructure · Victim
cl0p
Type: Unknown Active
TA505
FIN11
Shiny Hunters
UNC5936
2 technique(s) 40 tool(s)/malware 15 CVE(s)
Targeted Sectors
financial-services
government
defense
energy
transportation
media
pharmaceutical
critical-infrastructure
food-agriculture
education
retail
healthcare
manufacturing
information-technology
Targeted Countries
US
SG
RU
Diamond Model Meta-Features
Direction
Adversary → Infrastructure → Victim
Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Activity Threads
Kill chain phase → Diamond Model event mapping