Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

BackdoorDiplomacy (threat actor)

Risk

Medium

15 techniques 2 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

No data

›

5 Installation

T1046

Network Service Discovery discovery

T1049

System Network Connections Discovery discovery

T1120

Peripheral Device Discovery discovery

T1505.003

Web Shell persistence

›

6 Command & Control

T1074.001

Local Data Staging collection

T1095

Non-Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1036.004

Masquerade Task or Service stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055.001

Dynamic-link Library Injection stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

China Chopper Turian

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (4)

M1018 User Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1042 Disable or Remove Feature or Program

Command & Control (4)

M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit

Actions on Objectives (10)

M1013 Application Developer Guidance M1017 User Training M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +5 more

Detection Coverage

15 strategies

5/7 stages covered

Weaponization (2)

DET0845 Detection of Malware DET0852 Detection of Tool

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (4)

DET0320 Detection of System Network Connections... DET0376 Behavioral Detection Strategy for Networ... DET0394 Web Shell Detection via Server Behavior... DET0491 Peripheral Device Enumeration via System...

Command & Control (3)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0261 Detection of Local Data Staging Prior to... DET0457 Detection of Non-Application Layer Proto...

Actions on Objectives (5)

DET0117 Detection of Masqueraded Tasks or Servic... DET0201 Detection Strategy for Hijack Execution... DET0347 Detection Strategy for Masquerading via... DET0378 Behavioral Detection of Obfuscated Files... DET0389 Behavioral Detection of DLL Injection vi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

BackdoorDiplomacy

Type: Unknown Active

BackDip CloudComputating Quarian

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

15 technique(s) 2 tool(s)/malware

China Chopper Turian

collection

T1074.001

command and control

T1095 T1105

discovery

T1046 T1049 T1120

initial access

T1190

Victim

70%

Targeted Sectors

government telecommunications

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.001 T1588.002

Capability (Malware)

China Chopper Turian

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

China Chopper Turian

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1046 T1049 T1120 T1505.003

Capability (Malware)

China Chopper Turian

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1074.001 T1095 T1105

Capability (Malware)

China Chopper Turian

Infrastructure

No infra linked