Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT-C-34 (threat actor)

Risk

High

7 techniques 5 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

›

5 Installation

T1046

Network Service Discovery discovery

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1078.002

Domain Accounts stealth

T1060

T1086

Stage risk: Critical High Medium None

Tools & Malware (5)

Cobalt Strike Custom RAT Metasploit Framework Mimikatz PowerShell Empire

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (1)

M1038 Execution Prevention

Installation (3)

M1030 Network Segmentation M1031 Network Intrusion Prevention M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (5)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication

Detection Coverage

5 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (1)

DET0376 Behavioral Detection Strategy for Networ...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0210 Abuse of Domain Accounts

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

60%

APT-C-34

Type: Unknown Active

Golden Falcon

Infrastructure 0 IOC(s)

50%

No infrastructure indicators linked.

Capability

50%

7 technique(s) 5 tool(s)/malware

Cobalt Strike Custom RAT Metasploit Framework Mimikatz PowerShell Empire

T1060 T1086

command and control

T1105

discovery

T1046

execution

T1059.003

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Cobalt Strike Custom RAT Metasploit Framework

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Cobalt Strike Custom RAT Metasploit Framework

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1046

Capability (Malware)

Cobalt Strike Custom RAT Metasploit Framework

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Cobalt Strike Custom RAT Metasploit Framework

Infrastructure

No infra linked