Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Leafminer (threat actor)

Risk

Medium

17 techniques 0 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

›

4 Exploitation

T1059.007

JavaScript execution

›

5 Installation

T1003.001

LSASS Memory credential access

T1003.004

LSA Secrets credential access

T1003.005

Cached Domain Credentials credential access

T1110.003

Password Spraying credential access

T1552.001

Credentials In Files credential access

T1555

Credentials from Password Stores credential access

T1555.003

Credentials from Web Browsers credential access

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1083

File and Directory Discovery discovery

T1136.001

Local Account persistence

›

6 Command & Control

T1114.002

Remote Email Collection collection

›

7 Actions on Objectives

T1027.010

Command Obfuscation stealth

T1055.013

Process Doppelgänging stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (5)

M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Exploitation (4)

M1021 Restrict Web-Based Content M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program

Installation (18)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Command & Control (3)

M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information M1060 Out-of-Band Communications Channel

Actions on Objectives (2)

M1040 Behavior Prevention on Endpoint M1049 Antivirus/Antimalware

Detection Coverage

17 strategies

6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0264 Cross-Platform Detection of JavaScript E...

Installation (11)

DET0037 Detect Suspicious Access to Browser Cred... DET0307 Detect Access to Unsecured Credential Fi... DET0363 Detection of Credential Dumping from LSA... DET0370 Recursive Enumeration of Files and Direc... DET0376 Behavioral Detection Strategy for Networ... +6 more

Command & Control (1)

DET0048 Detect Remote Email Collection via Abnor...

Actions on Objectives (2)

DET0505 Detection Strategy for Command Obfuscati... DET0544 Detection Strategy for Process Doppelgän...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Leafminer

Type: Unknown Active

Raspite LeafMiner

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

17 technique(s)

collection

T1114.002

credential access

T1003.001 T1003.004 T1003.005 T1110.003 +3

discovery

T1018 T1046 T1083

execution

T1059.007

Victim

70%

Targeted Sectors

energy

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

—

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

—

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.007

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1003.001 T1003.004 T1003.005 T1110.003 T1552.001

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1114.002

Capability (Malware)

—

Infrastructure

No infra linked