Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Cobalt Group (threat actor)

Risk

High

34 techniques 4 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

T1195.002

Compromise Software Supply Chain initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1059.007

JavaScript execution

T1203

Exploitation for Client Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1559.002

Dynamic Data Exchange execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1548.002

Bypass User Account Control privilege escalation

›

5 Installation

T1046

Network Service Discovery discovery

T1518.001

Security Software Discovery discovery

T1037.001

Logon Script (Windows) persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1572

Protocol Tunneling command and control

T1573.002

Asymmetric Cryptography command and control

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1027.010

Command Obfuscation stealth

T1055

Process Injection stealth

T1070.004

File Deletion stealth

T1218.003

CMSTP stealth

T1218.008

Odbcconf stealth

T1218.010

Regsvr32 stealth

T1220

XSL Script Processing stealth

Stage risk: Critical High Medium None

Tools & Malware (4)

Cobalt Strike Cobalt Strike - S0154 More_eggs SpicyOmelette

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (9)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention +4 more

Exploitation (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management +13 more

Installation (9)

M1018 User Account Management M1024 Restrict Registry Permissions M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +4 more

Command & Control (13)

M1018 User Account Management M1020 SSL/TLS Inspection M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +8 more

Actions on Objectives (6)

M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program M1049 Antivirus/Antimalware +1 more

Detection Coverage

34 strategies

6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (3)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att... DET0309 Compromised software/update chain (insta...

Exploitation (11)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... +6 more

Installation (5)

DET0016 Security Software Discovery Across Platf... DET0072 Detect Logon Script Modifications and Ex... DET0365 Detect Registry and Startup Folder Persi... DET0376 Behavioral Detection Strategy for Networ... DET0552 Detection of Windows Service Creation or...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0327 Multi-event Detection Strategy for RDP-B... DET0400 Behavioral Detection of DNS Tunneling an... DET0496 Behavior-Chain Detection for Remote Acce... +2 more

Actions on Objectives (7)

DET0140 Behavioral Detection of Malicious File D... DET0205 Detect XSL Script Abuse via msxsl and wm... DET0282 Detection Strategy for System Binary Pro... DET0328 Detection of Malicious Profile Installat... DET0486 Detecting Odbcconf Proxy Execution of Ma... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Cobalt Group

Type: Unknown Active

GOLD KINGSWOOD Cobalt Gang Cobalt Spider Magecart Group 4 Cobalt Group +2 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

34 technique(s) 4 tool(s)/malware

Cobalt Strike Cobalt Strike - S0154 More_eggs SpicyOmelette

command and control

T1071.001 T1071.004 T1105 T1219 +2

discovery

T1046 T1518.001

execution

T1053.005 T1059.001 T1059.003 T1059.005 +5

initial access

T1195.002 T1566.001 T1566.002

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 More_eggs

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1195.002 T1566.001 T1566.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 More_eggs

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003 T1059.005 T1059.007

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 More_eggs

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1046 T1518.001 T1037.001 T1543.003 T1547.001

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 More_eggs

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1071.001 T1071.004 T1105 T1219 T1572

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 More_eggs

Infrastructure

No infra linked