Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Volatile Cedar (threat actor)

Risk

Medium

5 techniques 3 tools/malware 0 vulnerabilities 30 IOCs 4/7 stages covered Deepest: Command & Control

1 Reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1595.003

Wordlist Scanning reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

No data

›

5 Installation

T1505.003

Web Shell persistence

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (3)

Caterpillar WebShell Explosive Pallas

Indicators of Compromise (30)

MD5 Hash

3188df195d09ee38d89707501e330c2f 544fdcce998fc7f4bb2914b3ec5b4761 1aebf9d07fe6e82d97e062cdbe656a36 5d1f75bfc7cbd96891f26b1041fd5994 b54346cdaf9556eb88f3d95e0bad2be5 e9f0260409c6c964985fa4df926d7e04 33af1cd4585da9ed804068b2a45fc8b4 6ba944e9d3d96a46509204cd06ea2b11 +17 more

IPv4 Address

74.208.73.149 191.101.5.183 198.101.242.72 169.50.13.61 68.65.122.109

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1042 Disable or Remove Feature or Program M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (2)

M1018 User Account Management M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

5 strategies

4/7 stages covered

Reconnaissance (2)

DET0867 Detection of Vulnerability Scanning DET0868 Detection of Wordlist Scanning

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (1)

DET0394 Web Shell Detection via Server Behavior...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Volatile Cedar

Type: Unknown Active

Lebanese Cedar Lebanon DeftTorero VolcanicTimber Volatile Cedar

Infrastructure 5 IOC(s)

50%

IPv4 Address

74.208.73.149 191.101.5.183 198.101.242.72 169.50.13.61 68.65.122.109

Artifacts (25)

Capability

90%

5 technique(s) 3 tool(s)/malware

Caterpillar WebShell Explosive Pallas

command and control

T1105

initial access

T1190

persistence

T1505.003

reconnaissance

T1595.002 T1595.003

Victim

70%

Targeted Countries

US GB IL middle_east europe

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002 T1595.003

Capability (Malware)

Caterpillar WebShell Explosive Pallas

Infrastructure

74.208.73.149 191.101.5.183 198.101.242.72

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Caterpillar WebShell Explosive Pallas

Infrastructure

74.208.73.149 191.101.5.183 198.101.242.72

5 Installation

Capability (Techniques)

T1505.003

Capability (Malware)

Caterpillar WebShell Explosive Pallas

Infrastructure

74.208.73.149 191.101.5.183 198.101.242.72

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Caterpillar WebShell Explosive Pallas

Infrastructure

74.208.73.149 191.101.5.183 198.101.242.72