Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Rocke (threat actor)

Risk

Medium

36 techniques 0 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1053.003

Cron execution

T1059.004

Unix Shell execution

T1059.006

Python execution

›

5 Installation

T1552.004

Private Keys credential access

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1518.001

Security Software Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1543.002

Systemd Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1102

Web Service command and control

T1102.001

Dead Drop Resolver command and control

T1105

Ingress Tool Transfer command and control

T1571

Non-Standard Port command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1222.002

Linux and Mac Permissions defense impairment

T1685

Disable or Modify Tools defense impairment

T1685.006

Clear Linux or Mac System Logs defense impairment

T1686

Disable or Modify System Firewall defense impairment

T1496.001

Compute Hijacking impact

T1014

Rootkit stealth

T1027

Obfuscated Files or Information stealth

T1027.002

Software Packing stealth

T1027.004

Compile After Delivery stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055.002

Portable Executable Injection stealth

T1070.004

File Deletion stealth

T1070.006

Timestomp stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1564.001

Hidden Files and Directories stealth

T1574.006

Dynamic Linker Hijacking stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (5)

M1018 User Account Management M1033 Limit Software Installation M1038 Execution Prevention M1047 Audit M1049 Antivirus/Antimalware

Installation (11)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1027 Password Policies +6 more

Command & Control (7)

M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +2 more

Actions on Objectives (15)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +10 more

Detection Coverage

36 strategies

5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0063 Cross-Platform Behavioral Detection of P... DET0290 Cross-Platform Detection of Cron Job Abu... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (9)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0112 Boot or Logon Initialization Scripts Det... DET0253 Detection of Systemd Service Creation or... DET0365 Detect Registry and Startup Folder Persi... +4 more

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0058 Detection Strategy for Web Service: Dead... DET0060 Detect Ingress Tool Transfers via Behavi... DET0227 Detection Strategy for Non-Standard Port... DET0425 Suspicious Use of Web Services for C2 +2 more

Actions on Objectives (16)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0032 Detection Strategy for Hidden Files and... DET0106 Behavioral Detection of PE Injection via... DET0140 Behavioral Detection of Malicious File D... DET0145 Detection of Disabled or Modified System... +11 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Rocke

Type: Unknown Active

Rocke Aged Libra

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

36 technique(s)

command and control

T1071 T1071.001 T1102 T1102.001 +2

credential access

T1552.004

defense impairment

T1222.002 T1685 T1685.006 T1686

discovery

T1018 T1046 T1057 T1082 +1

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

—

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1053.003 T1059.004 T1059.006

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1552.004 T1018 T1046 T1057 T1082

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1102 T1102.001 T1105

Capability (Malware)

—

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1496.001

Capability (Malware)

—

Infrastructure

No infra linked