Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

INC Ransom (threat actor)

Risk

High

25 techniques 1 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.003

Windows Command Shell execution

T1569.002

Service Execution execution

›

5 Installation

T1046

Network Service Discovery discovery

T1049

System Network Connections Discovery discovery

T1069.002

Domain Groups discovery

T1087.002

Domain Account discovery

T1135

Network Share Discovery discovery

›

6 Command & Control

T1074

Data Staged collection

T1560.001

Archive via Utility collection

T1071

Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1021.001

Remote Desktop Protocol lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1537

Transfer Data to Cloud Account exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1036.005

Match Legitimate Resource Name or Location stealth

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (1)

INC Ransomware

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (5)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Installation (4)

M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention M1042 Disable or Remove Feature or Program

Command & Control (12)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +7 more

Actions on Objectives (19)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

25 strategies

6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex... DET0421 Detection Strategy for System Services S...

Installation (5)

DET0129 Domain Account Enumeration Across Platfo... DET0182 Behavior-chain detection for T1135 Netwo... DET0320 Detection of System Network Connections... DET0360 Behavioral Detection of Domain Group Dis... DET0376 Behavioral Detection Strategy for Networ...

Command & Control (7)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0183 Detection Strategy for Lateral Tool Tran... DET0298 Detect Archiving via Utility (T1560.001) DET0327 Multi-event Detection Strategy for RDP-B... +2 more

Actions on Objectives (7)

DET0140 Behavioral Detection of Malicious File D... DET0215 Detection of Multi-Platform File Encrypt... DET0347 Detection Strategy for Masquerading via... DET0495 Detection Strategy for Financial Theft DET0497 Detection of Defense Impairment through... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

INC Ransom

Type: Unknown Active

GOLD IONIC

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

25 technique(s) 1 tool(s)/malware

INC Ransomware

collection

T1074 T1560.001

command and control

T1071 T1105 T1219

defense impairment

T1685

discovery

T1046 T1049 T1069.002 T1087.002 +1

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1047 T1059.003 T1569.002

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1046 T1049 T1069.002 T1087.002 T1135

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1074 T1560.001 T1071 T1105 T1219

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1537 T1486 T1657

Capability (Malware)

INC Ransomware

Infrastructure

No infra linked