Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

8base (threat actor)

Risk

Critical

26 techniques 44 tools/malware 8 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1587

Develop Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1546.008

Accessibility Features privilege escalation

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

›

5 Installation

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1133

External Remote Services persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1486

Data Encrypted for Impact impact

T1490

Inhibit System Recovery impact

T1657

Financial Theft impact

T1027.001

Binary Padding stealth

T1134.001

Token Impersonation/Theft stealth

T1134.002

Create Process with Token stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218.005

Mshta stealth

T1497.001

System Checks stealth

T1060

T1070.001

T1562.004

Stage risk: Critical High Medium None

Tools & Malware (44)

8Base BITS Backdoors BianLian BlackSuit Cobalt Cobalt Strike Conti Dark GenKryptik Global Group Policy Interception Karma LaZagne Leverage LockBit Lynx Mimikatz Mythic Nexus Payload Payload Phishing emails Phobos Phobos Ransomware Pikabot PowerShell ProcDump PsExec Qilin RansomHouse Ransomware variants Royal Royal Ransomware STOP SentinelOne Singularity SmokeLoader Unknown mshta netsh phishing systemd

Indicators of Compromise (40)

Domain

tr.dldr Mallory.ai info.txt

Filename

info.hta 8base-ransomware-analyst-note.pdf msftesql.exe sqlagent.exe sqlbrowser.exe sqlservr.exe sqlwriter.exe oracle.exe +29 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (7)

M1026 Privileged Account Management M1028 Operating System Configuration M1035 Limit Access to Resource Over Network M1038 Execution Prevention M1047 Audit +2 more

Installation (6)

M1021 Restrict Web-Based Content M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +1 more

Actions on Objectives (14)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Detection Coverage

23 strategies

5/7 stages covered

Weaponization (2)

DET0853 Detection of Develop Capabilities DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0033 Detection Strategy for Accessibility Fea... DET0388 Detection Strategy for T1548.002 – Bypas...

Installation (6)

DET0034 Detection of Adversarial Process Discove... DET0182 Behavior-chain detection for T1135 Netwo... DET0354 Behavior-chain detection for T1133 Exter... DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc... +1 more

Actions on Objectives (11)

DET0131 Behavioral Detection Strategy for Exfilt... DET0168 Virtualization/Sandbox Evasion via Syste... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0329 Behavioral Detection for T1490 - Inhibit... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

8base

Type: Criminal Sophistication: Medium First seen: 2022 Active

tracked as double extortion Fox Kitten UNC757 BlackCat +14 more

Infrastructure 3 IOC(s)

50%

Domain

tr.dldr Mallory.ai info.txt

Artifacts (37)

info.hta 8base-ransomware-analyst-note.pdf msftesql.exe sqlagent.exe sqlbrowser.exe sqlservr.exe +31

Capability

50%

26 technique(s) 44 tool(s)/malware 8 CVE(s)

8Base BITS Backdoors BianLian BlackSuit Cobalt Cobalt Strike Conti +36

T1060 T1070.001 T1562.004

discovery

T1057 T1082 T1083 T1135

exfiltration

T1048 T1567

impact

T1486 T1490 T1657

Victim

70%

Targeted Sectors

government financial-services energy defense healthcare telecommunications education manufacturing critical-infrastructure information-technology transportation media hospitality construction non-profit aerospace maritime retail nuclear chemical aviation think-tank oil-gas legal-services entertainment gaming food-agriculture

Targeted Countries

CN US UA GB IN RU AU JP DE IR CA PL TW VN KR BR KP SG IL FR PK BY KZ TR MX ES IT NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2022-04-03

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1587

Capability (Malware)

8Base BITS Backdoors

Infrastructure

tr.dldr Mallory.ai info.txt

3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

8Base BITS Backdoors

Infrastructure

tr.dldr Mallory.ai info.txt

4 Exploitation

Capability (Techniques)

T1546.008 T1548.002

Capability (Malware)

8Base BITS Backdoors

Infrastructure

tr.dldr Mallory.ai info.txt

5 Installation

Capability (Techniques)

T1057 T1082 T1083 T1135 T1133

Capability (Malware)

8Base BITS Backdoors

Infrastructure

tr.dldr Mallory.ai info.txt

7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1490 T1657

Capability (Malware)

8Base BITS Backdoors

Infrastructure

tr.dldr Mallory.ai info.txt