Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Daggerfly (threat actor)

Risk

High

17 techniques 4 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1584.004

Server resource development

T1587.002

Code Signing Certificates resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1195.002

Compromise Software Supply Chain initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1204.001

Malicious Link execution

›

5 Installation

T1003.002

Security Account Manager credential access

T1012

Query Registry discovery

T1082

System Information Discovery discovery

T1136.001

Local Account persistence

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1036.003

Rename Legitimate Utilities stealth

T1218.011

Rundll32 stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (4)

MacMa MgBot Nightdoor PlugX

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more

Exploitation (11)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +6 more

Installation (5)

M1017 User Training M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1032 Multi-factor Authentication

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (7)

M1013 Application Developer Guidance M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1044 Restrict Library Loading M1047 Audit +2 more

Detection Coverage

17 strategies

6/7 stages covered

Weaponization (2)

DET0833 Detection of Code Signing Certificates DET0874 Detection of Server

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0309 Compromised software/update chain (insta...

Exploitation (3)

DET0066 User Execution – Malicious Link (click →... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (4)

DET0085 Credential Dumping from SAM via Registry... DET0209 Detection of Registry Query for Environm... DET0447 T1136.001 Detection Strategy - Local Acc... DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (4)

DET0005 Renamed Legitimate Utility Execution wit... DET0201 Detection Strategy for Hijack Execution... DET0230 Detect Suspicious or Malicious Code Sign... DET0475 Detection Strategy for T1218.011 Rundll3...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Daggerfly

Type: Unknown Active

Evasive Panda BRONZE HIGHLAND Daggerfly

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

17 technique(s) 4 tool(s)/malware

MacMa MgBot Nightdoor PlugX

command and control

T1071.001 T1105

credential access

T1003.002

defense impairment

T1553.002

discovery

T1012 T1082

Victim

70%

Targeted Sectors

government

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1584.004 T1587.002

Capability (Malware)

MacMa MgBot Nightdoor

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1189 T1195.002

Capability (Malware)

MacMa MgBot Nightdoor

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1204.001

Capability (Malware)

MacMa MgBot Nightdoor

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1003.002 T1012 T1082 T1136.001

Capability (Malware)

MacMa MgBot Nightdoor

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

MacMa MgBot Nightdoor

Infrastructure

No infra linked