Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TeamTNT (threat actor)

Risk

High

56 techniques 1 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1595.001

Scanning IP Blocks reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1587.001

Malware resource development

T1608.001

Upload Malware resource development

›

3 Delivery

No data

›

4 Exploitation

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

T1059.009

Cloud API execution

T1059.013

Container CLI/API execution

T1204.003

Malicious Image execution

T1569.003

Systemctl execution

T1609

Container Administration Command execution

T1610

Deploy Container execution

T1611

Escape to Host privilege escalation

›

5 Installation

T1552.001

Credentials In Files credential access

T1552.004

Private Keys credential access

T1552.005

Cloud Instance Metadata API credential access

T1007

System Service Discovery discovery

T1016

System Network Configuration Discovery discovery

T1046

Network Service Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1120

Peripheral Device Discovery discovery

T1518.001

Security Software Discovery discovery

T1613

Container and Resource Discovery discovery

T1680

Local Storage Discovery discovery

T1098.004

SSH Authorized Keys persistence

T1133

External Remote Services persistence

T1136.001

Local Account persistence

T1543.002

Systemd Service persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1074.001

Local Data Staging collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1222.002

Linux and Mac Permissions defense impairment

T1685

Disable or Modify Tools defense impairment

T1685.006

Clear Linux or Mac System Logs defense impairment

T1686

Disable or Modify System Firewall defense impairment

T1048

Exfiltration Over Alternative Protocol exfiltration

T1496.001

Compute Hijacking impact

T1014

Rootkit stealth

T1027.002

Software Packing stealth

T1027.013

Encrypted/Encoded File stealth

T1036

Masquerading stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1070.003

Clear Command History stealth

T1070.004

File Deletion stealth

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (1)

Hildegard

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Exploitation (13)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention +8 more

Installation (18)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +13 more

Command & Control (8)

M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1034 Limit Hardware Installation +3 more

Actions on Objectives (19)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +14 more

Detection Coverage

56 strategies

6/7 stages covered

Reconnaissance (2)

DET0817 Detection of Scanning IP Blocks DET0867 Detection of Vulnerability Scanning

Weaponization (3)

DET0824 Detection of Upload Malware DET0872 Detection of Malware DET0892 Detection of Domains

Exploitation (10)

DET0065 Detection Strategy for Container Adminis... DET0073 Detection Strategy for System Services:... DET0078 Behavioral Detection of Malicious Cloud... DET0083 Container CLI and API Abuse via Docker/K... DET0202 Behavioral Detection of Windows Command... +5 more

Installation (20)

DET0001 Detect Access to Cloud Instance Metadata... DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0126 Detection Strategy for SSH Key Injection... DET0188 Local Storage Discovery via Drive Enumer... +15 more

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0261 Detection of Local Data Staging Prior to... DET0425 Suspicious Use of Web Services for C2 DET0444 Detection of Command and Control Over Ap... +2 more

Actions on Objectives (14)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0140 Behavioral Detection of Malicious File D... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

TeamTNT

Type: Unknown Active

Adept Libra

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

56 technique(s) 1 tool(s)/malware

Hildegard

collection

T1074.001

command and control

T1071 T1071.001 T1102 T1105 +1

credential access

T1552.001 T1552.004 T1552.005

defense impairment

T1222.002 T1685 T1685.006 T1686

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.001 T1595.002

Capability (Malware)

Hildegard

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583.001 T1587.001 T1608.001

Capability (Malware)

Hildegard

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.001 T1059.003 T1059.004 T1059.009 T1059.013

Capability (Malware)

Hildegard

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1552.001 T1552.004 T1552.005 T1007 T1016

Capability (Malware)

Hildegard

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1074.001 T1071 T1071.001 T1102 T1105

Capability (Malware)

Hildegard

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1048 T1496.001

Capability (Malware)

Hildegard

Infrastructure

No infra linked