Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Attor (threat actor)

Risk

Critical

40 techniques 51 tools/malware 3 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1106

Native API execution

T1129

Shared Modules execution

T1569

System Services execution

CVE CVE-2014-6352

CVE CVE-2022-42475

CVE CVE-2024-3400

›

5 Installation

T1010

Application Window Discovery discovery

T1012

Query Registry discovery

T1083

File and Directory Discovery discovery

T1120

Peripheral Device Discovery discovery

T1680

Local Storage Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1543

Create or Modify System Process persistence

›

6 Command & Control

T1056

Input Capture collection

T1074

Data Staged collection

T1113

Screen Capture collection

T1115

Clipboard Data collection

T1119

Automated Collection collection

T1123

Audio Capture collection

T1560

Archive Collected Data collection

T1071

Application Layer Protocol command and control

T1090

Proxy command and control

T1105

Ingress Tool Transfer command and control

T1573

Encrypted Channel command and control

T1573.001

Symmetric Cryptography command and control

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1036.004

Masquerade Task or Service stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218

System Binary Proxy Execution stealth

T1497

Virtualization/Sandbox Evasion stealth

T1564

Hide Artifacts stealth

T1035

T1050

T1085

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (51)

AcidRain Akira AsyncRAT Attor Backdoor malware Backdoors BeaverTail Black Basta BlackByte BlackByte Ransomware Cobalt Cobalt Strike Conti Custom Backdoor Desert Scorpion Exaramel FiveHands GitHub IcedID Kimsuky LockBit Mango Medusa Medusa Ransomware Mimikatz MiniDuke Mobile malware MuddyWater NOKKI Naikon OilRig PLAY Payload Payload PlugX PowerShell PowerShell backdoor PsExec QakBot RedLine Rootkit Royal Shamoon SolarWinds SpyC23 TrickBot Trojan Turla Web Shell phishing route

Indicators of Compromise (40)

Domain

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps AdDisplay.Ashas DEADEYE.EMBED Backdoor.Linux.BPFDOOR Backdoor.Solaris.BPFDOOR.ZAJE Backdoor.APT.FakeWinHTTPHelper +15 more

Filename

esentutl.exe rundll32.exe Node.js net.exe mscorsvc.dll cipher.exe PACLOUD.exe csc.exe +9 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (7)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +2 more

Installation (10)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1028 Operating System Configuration +5 more

Command & Control (6)

M1020 SSL/TLS Inspection M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information +1 more

Actions on Objectives (20)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more

Detection Coverage

35 strategies

4/7 stages covered

Exploitation (4)

DET0018 Behavior-chain, platform-aware detection... DET0094 Cross-Platform Behavioral Detection of S... DET0279 Detection Strategy for System Services a... DET0529 Behavioral Detection of Native API Invoc...

Installation (7)

DET0097 Detection of Application Window Enumerat... DET0112 Boot or Logon Initialization Scripts Det... DET0188 Local Storage Discovery via Drive Enumer... DET0209 Detection of Registry Query for Environm... DET0370 Recursive Enumeration of Files and Direc... +2 more

Command & Control (12)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0102 Behavioral Detection of Input Capture Ac... DET0143 Detection Strategy for Encrypted Channel... DET0186 Automated File and API Collection Detect... +7 more

Actions on Objectives (12)

DET0046 Detection Strategy for T1497 Virtualizat... DET0081 Detection of Proxy Execution via Trusted... DET0117 Detection of Masqueraded Tasks or Servic... DET0127 Behavioral Detection of Masquerading Acr... DET0184 Behavioral Detection of Indicator Remova... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Attor

Type: Nation-State Active

middle the Register of Actions Project Spy Cridex similar to Sliver +9 more

Infrastructure 23 IOC(s)

50%

Domain

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps AdDisplay.Ashas DEADEYE.EMBED +18

Artifacts (17)

esentutl.exe rundll32.exe Node.js net.exe mscorsvc.dll cipher.exe +11

Capability

50%

40 technique(s) 51 tool(s)/malware 3 CVE(s)

AcidRain Akira AsyncRAT Attor Backdoor malware Backdoors BeaverTail Black Basta +43

T1035 T1050 T1085 T5000 +1

collection

T1056 T1074 T1113 T1115 +3

command and control

T1071 T1090 T1105 T1573 +1

defense impairment

T1112

Victim

70%

Targeted Sectors

government financial-services defense telecommunications manufacturing education healthcare energy transportation media critical-infrastructure non-profit information-technology retail aerospace hospitality legal-services mining pharmaceutical aviation maritime chemical nuclear gaming utilities

Targeted Countries

US RU UA BR KR CN MX GB IN PL AU DE ES CA JP IL TR SY TW IT SA IR FR VN SG PK AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1053 T1106 T1129 T1569

Capability (Malware)

AcidRain Akira AsyncRAT

Infrastructure

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps

5 Installation

Capability (Techniques)

T1010 T1012 T1083 T1120 T1680

Capability (Malware)

AcidRain Akira AsyncRAT

Infrastructure

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps

6 Command & Control

Capability (Techniques)

T1056 T1074 T1113 T1115 T1119

Capability (Malware)

AcidRain Akira AsyncRAT

Infrastructure

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps

7 Actions on Objectives

Capability (Techniques)

T1020 T1041

Capability (Malware)

AcidRain Akira AsyncRAT

Infrastructure

Yandex.Mail Trojan.Karagany Trojan-SMS.AndroidOS.Smaps