Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Tropic Trooper (threat actor)

Risk

High

40 techniques 7 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1106

Native API execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1033

System Owner/User Discovery discovery

T1046

Network Service Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1518

Software Discovery discovery

T1518.001

Security Software Discovery discovery

T1680

Local Storage Discovery discovery

T1505.003

Web Shell persistence

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

T1547.004

Winlogon Helper DLL persistence

›

6 Command & Control

T1119

Automated Collection collection

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1105

Ingress Tool Transfer command and control

T1132.001

Standard Encoding command and control

T1573

Encrypted Channel command and control

T1573.002

Asymmetric Cryptography command and control

T1091

Replication Through Removable Media lateral movement

›

7 Actions on Objectives

T1020

Automated Exfiltration exfiltration

T1052.001

Exfiltration over USB exfiltration

T1027.003

Steganography stealth

T1027.013

Encrypted/Encoded File stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055.001

Dynamic-link Library Injection stealth

T1070.004

File Deletion stealth

T1078.003

Local Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1221

Template Injection stealth

T1564.001

Hidden Files and Directories stealth

T1574.001

DLL stealth

Stage risk: Critical High Medium None

Tools & Malware (7)

KeyBoy PcShare Poison Ivy PoisonIvy ShadowPad USBferry YAHOYAH

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more

Installation (9)

M1018 User Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention M1038 Execution Prevention +4 more

Command & Control (8)

M1020 SSL/TLS Inspection M1029 Remote Data Storage M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic +3 more

Actions on Objectives (18)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +13 more

Detection Coverage

40 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0529 Behavioral Detection of Native API Invoc...

Installation (15)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0182 Behavior-chain detection for T1135 Netwo... DET0188 Local Storage Discovery via Drive Enumer... +10 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0186 Automated File and API Collection Detect... DET0273 Detection Strategy for Encrypted Channel... +3 more

Actions on Objectives (12)

DET0032 Detection Strategy for Hidden Files and... DET0087 Encrypted or Encoded File Payload Detect... DET0119 Detection Strategy for Steganographic Ab... DET0140 Behavioral Detection of Malicious File D... DET0201 Detection Strategy for Hijack Execution... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Tropic Trooper

Type: Unknown Active

Pirate Panda KeyBoy KeyBoys Tropic Trooper BRONZE HOBART +3 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

40 technique(s) 7 tool(s)/malware

KeyBoy PcShare Poison Ivy PoisonIvy ShadowPad USBferry YAHOYAH

collection

T1119

command and control

T1071.001 T1071.004 T1105 T1132.001 +2

discovery

T1016 T1033 T1046 T1049 +7

execution

T1059.003 T1106 T1203 T1204.002

Victim

70%

Targeted Sectors

government healthcare transportation

Targeted Countries

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

KeyBoy PcShare Poison Ivy

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003 T1106 T1203 T1204.002

Capability (Malware)

KeyBoy PcShare Poison Ivy

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1016 T1033 T1046 T1049 T1057

Capability (Malware)

KeyBoy PcShare Poison Ivy

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1119 T1071.001 T1071.004 T1105 T1132.001

Capability (Malware)

KeyBoy PcShare Poison Ivy

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1020 T1052.001

Capability (Malware)

KeyBoy PcShare Poison Ivy

Infrastructure

No infra linked