Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Moses Staff (threat actor)

Risk

Medium

12 techniques 3 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

No data

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1082

System Information Discovery discovery

T1087.001

Local Account discovery

T1505.003

Web Shell persistence

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

T1021.002

SMB/Windows Admin Shares lateral movement

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1686.003

Windows Host Firewall defense impairment

T1027.013

Encrypted/Encoded File stealth

Stage risk: Critical High Medium None

Tools & Malware (3)

DCSrv PyDCrypt StrifeWater

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (3)

M1018 User Account Management M1028 Operating System Configuration M1042 Disable or Remove Feature or Program

Command & Control (5)

M1026 Privileged Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic

Actions on Objectives (6)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1040 Behavior Prevention on Endpoint M1047 Audit +1 more

Detection Coverage

12 strategies

5/7 stages covered

Weaponization (2)

DET0852 Detection of Tool DET0872 Detection of Malware

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (4)

DET0195 Behavioral Detection of System Network C... DET0303 Local Account Enumeration Across Host Pl... DET0394 Web Shell Detection via Server Behavior... DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0530 Multi-Event Detection for SMB Admin Shar...

Actions on Objectives (3)

DET0087 Encrypted or Encoded File Payload Detect... DET0230 Detect Suspicious or Malicious Code Sign... DET0901 Detect Windows Firewall

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Moses Staff

Type: Unknown Active

DEV-0500 Marigold Sandstorm Moses Staff VENGEFUL KITTEN

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

12 technique(s) 3 tool(s)/malware

DCSrv PyDCrypt StrifeWater

command and control

T1105

defense impairment

T1553.002 T1686.003

discovery

T1016 T1082 T1087.001

initial access

T1190

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587.001 T1588.002

Capability (Malware)

DCSrv PyDCrypt StrifeWater

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

DCSrv PyDCrypt StrifeWater

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1016 T1082 T1087.001 T1505.003

Capability (Malware)

DCSrv PyDCrypt StrifeWater

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1105 T1021.002

Capability (Malware)

DCSrv PyDCrypt StrifeWater

Infrastructure

No infra linked