Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

HEXANE (threat actor)

Risk

High

36 techniques 5 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

T1589.002

Email Addresses reconnaissance

T1591.004

Identify Roles reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1583.002

DNS Server resource development

T1585.001

Social Media Accounts resource development

T1585.002

Email Accounts resource development

T1586.002

Email Accounts resource development

T1588.002

Tool resource development

T1608.001

Upload Malware resource development

›

3 Delivery

No data

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

T1204.002

Malicious File execution

T1546.003

Windows Management Instrumentation Event Subscription privilege escalation

›

5 Installation

T1110

Brute Force credential access

T1110.003

Password Spraying credential access

T1555

Credentials from Password Stores credential access

T1555.003

Credentials from Web Browsers credential access

T1010

Application Window Discovery discovery

T1016

System Network Configuration Discovery discovery

T1016.001

Internet Connection Discovery discovery

T1018

Remote System Discovery discovery

T1033

System Owner/User Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1069.001

Local Groups discovery

T1082

System Information Discovery discovery

T1518

Software Discovery discovery

›

6 Command & Control

T1056.001

Keylogging collection

T1102.002

Bidirectional Communication command and control

T1105

Ingress Tool Transfer command and control

T1021.001

Remote Desktop Protocol lateral movement

T1534

Internal Spearphishing lateral movement

›

7 Actions on Objectives

T1567.002

Exfiltration to Cloud Storage exfiltration

T1027.010

Command Obfuscation stealth

Stage risk: Critical High Medium None

Tools & Malware (5)

DanBot DnsSystem Kevin Milan Shark

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Exploitation (11)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +6 more

Installation (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +3 more

Command & Control (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +6 more

Actions on Objectives (3)

M1021 Restrict Web-Based Content M1040 Behavior Prevention on Endpoint M1049 Antivirus/Antimalware

Detection Coverage

36 strategies

6/7 stages covered

Reconnaissance (3)

DET0807 Detection of Identify Roles DET0814 Detection of Email Addresses DET0841 Detection of Gather Victim Identity Info...

Weaponization (7)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0851 Detection of Social Media Accounts DET0852 Detection of Tool DET0861 Detection of Email Accounts +2 more

Exploitation (5)

DET0076 Behavioral Detection of Visual Basic Exe... DET0086 Detect WMI Event Subscription for Persis... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (14)

DET0034 Detection of Adversarial Process Discove... DET0037 Detect Suspicious Access to Browser Cred... DET0093 Behavioral Detection of User Discovery v... DET0097 Detection of Application Window Enumerat... DET0114 Behavioral Detection of Local Group Enum... +9 more

Command & Control (5)

DET0035 Detect Bidirectional Web Service C2 Chan... DET0054 Internal Spearphishing via Trusted Accou... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0327 Multi-event Detection Strategy for RDP-B...

Actions on Objectives (2)

DET0505 Detection Strategy for Command Obfuscati... DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

HEXANE

Type: Unknown Active

Lyceum Siamesekitten Spirlin HEXANE COBALT LYCEUM +4 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

36 technique(s) 5 tool(s)/malware

DanBot DnsSystem Kevin Milan Shark

collection

T1056.001

command and control

T1102.002 T1105

credential access

T1110 T1110.003 T1555 T1555.003

discovery

T1010 T1016 T1016.001 T1018 +6

Victim

70%

Targeted Sectors

government energy telecommunications education defense

Targeted Countries

IR middle_east

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1589.002 T1591.004

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583.001 T1583.002 T1585.001 T1585.002 T1586.002

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.005 T1204.002 T1546.003

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1110 T1110.003 T1555 T1555.003 T1010

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1056.001 T1102.002 T1105 T1021.001 T1534

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1567.002

Capability (Malware)

DanBot DnsSystem Kevin

Infrastructure

No infra linked