Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TeamPCP (threat actor)

Risk

High

36 techniques 3 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.004

Server resource development

T1583.006

Web Services resource development

T1585.001

Social Media Accounts resource development

T1587.001

Malware resource development

T1608.001

Upload Malware resource development

T1683.001

Written Content resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195.001

Compromise Software Dependencies and Development Tools initial access

›

4 Exploitation

T1059.004

Unix Shell execution

T1059.006

Python execution

T1059.007

JavaScript execution

T1059.013

Container CLI/API execution

T1677

Poisoned Pipeline Execution execution

T1546.016

Installer Packages privilege escalation

›

5 Installation

T1528

Steal Application Access Token credential access

T1552.004

Private Keys credential access

T1555.006

Cloud Secrets Management Stores credential access

T1098

Account Manipulation persistence

T1176.002

IDE Extensions persistence

T1543.002

Systemd Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1105

Ingress Tool Transfer command and control

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1027.003

Steganography stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T1564.001

Hidden Files and Directories stealth

T1684.001

Impersonation stealth

Stage risk: Critical High Medium None

Tools & Malware (3)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (10)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1033 Limit Software Installation +5 more

Exploitation (10)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +5 more

Installation (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Command & Control (8)

M1013 Application Developer Guidance M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1036 Account Use Policies M1037 Filter Network Traffic +3 more

Actions on Objectives (14)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +9 more

Detection Coverage

36 strategies

6/7 stages covered

Weaponization (8)

DET0824 Detection of Upload Malware DET0851 Detection of Social Media Accounts DET0871 Detection of Server DET0872 Detection of Malware DET0892 Detection of Domains +3 more

Delivery (2)

DET0009 Supply-chain tamper in dependencies/dev-... DET0080 Exploit Public-Facing Application – mult...

Exploitation (6)

DET0063 Cross-Platform Behavioral Detection of P... DET0083 Container CLI and API Abuse via Docker/K... DET0264 Cross-Platform Detection of JavaScript E... DET0330 Detection Strategy for T1546.016 - Event... DET0384 Behavioral Detection of Unix Shell Execu... +1 more

Installation (7)

DET0096 Account Manipulation Behavior Chain Dete... DET0130 Detect Unauthorized Access to Cloud Secr... DET0253 Detection of Systemd Service Creation or... DET0365 Detect Registry and Startup Folder Persi... DET0515 Detection Strategy for T1528 - Steal App... +2 more

Command & Control (3)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0185 Behavioral Detection Strategy for Use Al... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (10)

DET0032 Detection Strategy for Hidden Files and... DET0119 Detection Strategy for Steganographic Ab... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0230 Detect Suspicious or Malicious Code Sign... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

50%

TeamPCP

Type: apt Active

Altered Spider PCPcat ShellForce DeadCatx3 CanisterWorm +2 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

36 technique(s) 3 tool(s)/malware

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

collection

T1005

command and control

T1105

credential access

T1528 T1552.004 T1555.006

defense impairment

T1553.002

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Apt

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.004 T1583.006 T1585.001

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190 T1195.001

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.004 T1059.006 T1059.007 T1059.013 T1677

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1528 T1552.004 T1555.006 T1098 T1176.002

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1005 T1105 T1550.001

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1485 T1486 T1657

Capability (Malware)

CanisterWorm Mini Shai-Hulud TeamPCP Cloud Stealer

Infrastructure

No infra linked