Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

VOID MANTICORE (threat actor)

Risk

High

63 techniques 0 tools/malware 0 vulnerabilities 0 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1583.006

Web Services resource development

T1585.001

Social Media Accounts resource development

T1585.002

Email Accounts resource development

T1587.001

Malware resource development

T1588.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1199

Trusted Relationship initial access

T1566

Phishing initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.001

PowerShell execution

T1059.006

Python execution

T1072

Software Deployment Tools execution

T1204.002

Malicious File execution

T1651

Cloud Administration Command execution

›

5 Installation

T1003.001

LSASS Memory credential access

T1110

Brute Force credential access

T1110.001

Password Guessing credential access

T1110.004

Credential Stuffing credential access

T1552.002

Credentials in Registry credential access

T1082

System Information Discovery discovery

T1087.002

Domain Account discovery

T1098

Account Manipulation persistence

T1133

External Remote Services persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074

Data Staged collection

T1113

Screen Capture collection

T1114.002

Remote Email Collection collection

T1119

Automated Collection collection

T1123

Audio Capture collection

T1125

Video Capture collection

T1213.002

Sharepoint collection

T1560.001

Archive via Utility collection

T1071.001

Web Protocols command and control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

T1219.002

Remote Desktop Software command and control

T1572

Protocol Tunneling command and control

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1484.001

Group Policy Modification defense impairment

T1686.003

Windows Host Firewall defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1490

Inhibit System Recovery impact

T1561.001

Disk Content Wipe impact

T1561.002

Disk Structure Wipe impact

T1657

Financial Theft impact

T1027.015

Compression stealth

T1036.004

Masquerade Task or Service stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1078

Valid Accounts stealth

T1078.002

Domain Accounts stealth

T1078.004

Cloud Accounts stealth

T1564.003

Hidden Window stealth

T1679

Selective Exclusion stealth

T1684.001

Impersonation stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (16)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more

Exploitation (16)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +11 more

Installation (17)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +12 more

Command & Control (17)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +12 more

Actions on Objectives (21)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +16 more

Detection Coverage

63 strategies

7/7 stages covered

Reconnaissance (2)

DET0841 Detection of Gather Victim Identity Info... DET0867 Detection of Vulnerability Scanning

Weaponization (9)

DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0845 Detection of Malware DET0851 Detection of Social Media Accounts DET0852 Detection of Tool +4 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0488 Detect abuse of Trusted Relationships (t...

Exploitation (6)

DET0063 Cross-Platform Behavioral Detection of P... DET0223 Detection of Adversary Abuse of Software... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut... +1 more

Installation (10)

DET0096 Account Manipulation Behavior Chain Dete... DET0129 Domain Account Enumeration Across Platfo... DET0250 Detect Credential Discovery via Windows... DET0354 Behavior-chain detection for T1133 Exter... DET0363 Detection of Credential Dumping from LSA... +5 more

Command & Control (15)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0048 Detect Remote Email Collection via Abnor... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect... +10 more

Actions on Objectives (18)

DET0117 Detection of Masqueraded Tasks or Servic... DET0128 Detection Strategy for Hidden Windows DET0146 Detection of Data Destruction Across Pla... DET0210 Abuse of Domain Accounts DET0215 Detection of Multi-Platform File Encrypt... +13 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

VOID MANTICORE

Type: Unknown Active

COBALT MYSTIQUE Handala Hack Homeland Justice Karma Karmabelow80 +4 more

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

63 technique(s)

collection

T1005 T1074 T1113 T1114.002 +5

command and control

T1071.001 T1102 T1105 T1219.002 +1

credential access

T1003.001 T1110 T1110.001 T1110.004 +1

defense impairment

T1484.001 T1686.003

Victim

70%

Targeted Sectors

government healthcare pharmaceutical telecommunications education media non-profit

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1595.002

Capability (Malware)

—

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583.001 T1583.003 T1583.004 T1583.006 T1585.001

Capability (Malware)

—

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190 T1199 T1566

Capability (Malware)

—

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1047 T1059.001 T1059.006 T1072 T1204.002

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1003.001 T1110 T1110.001 T1110.004 T1552.002

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1005 T1074 T1113 T1114.002 T1119

Capability (Malware)

—

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1041 T1485 T1486 T1490 T1561.001

Capability (Malware)

—

Infrastructure

No infra linked