Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

FIN10 (threat actor)

Risk

Medium

11 techniques 0 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

No data

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

›

5 Installation

T1033

System Owner/User Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1021.001

Remote Desktop Protocol lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

T1078.003

Local Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1042 Disable or Remove Feature or Program +3 more

Command & Control (10)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +5 more

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

11 strategies

5/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0093 Behavioral Detection of User Discovery v... DET0365 Detect Registry and Startup Folder Persi...

Command & Control (2)

DET0183 Detection Strategy for Lateral Tool Tran... DET0327 Multi-event Detection Strategy for RDP-B...

Actions on Objectives (3)

DET0140 Behavioral Detection of Malicious File D... DET0407 Detection of Local Account Abuse for Ini... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

FIN10

Type: Unknown Active

G0051

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

11 technique(s)

discovery

T1033

execution

T1053.005 T1059.001 T1059.003

lateral movement

T1021.001 T1570

persistence

T1547.001

Victim

70%

Targeted Sectors

gaming

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

—

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1033 T1547.001

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1021.001 T1570

Capability (Malware)

—

Infrastructure

No infra linked