Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

admin@338 (threat actor)

Risk

High

12 techniques 5 tools/malware 0 vulnerabilities 0 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

›

5 Installation

T1007

System Service Discovery discovery

T1016

System Network Configuration Discovery discovery

T1049

System Network Connections Discovery discovery

T1069.001

Local Groups discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1087.001

Local Account discovery

›

6 Command & Control

No data

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

Stage risk: Critical High Medium None

Tools & Malware (5)

BUBBLEWRAP LOWBALL Poison Ivy PoisonIvy jRAT

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more

Installation (1)

M1028 Operating System Configuration

Actions on Objectives (3)

M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing

Detection Coverage

12 strategies

4/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down...

Installation (7)

DET0114 Behavioral Detection of Local Group Enum... DET0195 Behavioral Detection of System Network C... DET0303 Local Account Enumeration Across Host Pl... DET0320 Detection of System Network Connections... DET0370 Recursive Enumeration of Files and Direc... +2 more

Actions on Objectives (1)

DET0347 Detection Strategy for Masquerading via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

admin@338

Type: Unknown Active

Temper Panda Admin338 Team338 admin@338 338 Team +2 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

12 technique(s) 5 tool(s)/malware

BUBBLEWRAP LOWBALL Poison Ivy PoisonIvy jRAT

discovery

T1007 T1016 T1049 T1069.001 +3

execution

T1059.003 T1203 T1204.002

initial access

T1566.001

stealth

T1036.005

Victim

70%

Targeted Sectors

defense think tank government

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

BUBBLEWRAP LOWBALL Poison Ivy

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003 T1203 T1204.002

Capability (Malware)

BUBBLEWRAP LOWBALL Poison Ivy

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1007 T1016 T1049 T1069.001 T1082

Capability (Malware)

BUBBLEWRAP LOWBALL Poison Ivy

Infrastructure

No infra linked