Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Houndstooth Typhoon (threat actor)
Risk
57
High
10 techniques 51 tools/malware 1 vulnerabilities 4 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
3
T1059.003
Windows Command Shell execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2017-0005
›
5 Installation
2
T1003
OS Credential Dumping credential access
T1087
Account Discovery discovery
›
6 Command & Control
4
T1056.001
Keylogging collection
T1074
Data Staged collection
T1105
Ingress Tool Transfer command and control
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
2
T1112
Modify Registry defense impairment
T1491.001
Internal Defacement impact
Stage risk: Critical High Medium None

Tools & Malware (51)

Agent Tesla Anubis Athena Aurora BANSHEE BARIUM BLINDINGCAN BeaverTail Chollima Citrine Sleet Cobalt Cobalt Strike Codex Conti Covenant Crimson Dark DeputyDog Emissary Ghost RAT GitHub Global Hafnium Imperial Kitten Jackal Kimsuky Kraken Labyrinth Labyrinth Chollima Luna Lynx Mango Matrix Moonstone Sleet Mythic OceanLotus OilRig Phoenix Pink PlugX Sednit Smoke Sandstorm Sofacy SparkRAT Tsunami Turla Void WAVESHAPER Wicked Winnti phishing

Indicators of Compromise (4)

Domain
360.net TEMP.Zagros TEMP.Periscope MicrosoftMapping.json

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (5)
M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Installation (10)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +5 more
Command & Control (7)
M1013 Application Developer Guidance M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1036 Account Use Policies M1037 Filter Network Traffic +2 more
Actions on Objectives (2)
M1024 Restrict Registry Permissions M1053 Data Backup

Detection Coverage

10 strategies
4/7 stages covered

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0514 Detection Strategy for Exploitation for...

Installation (2)

DET0234 Credential Dumping via Sensitive Memory... DET0587 Enumeration of User or Account Informati...

Command & Control (4)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0185 Behavioral Detection Strategy for Use Al...

Actions on Objectives (2)

DET0082 Internal Website and System Content Defa... DET0280 Behavior-Based Registry Modification Det...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Houndstooth Typhoon

Type: Unknown Active
HASSIUM DRAGNET PANDA isoon deepclif tracked as +1 more
Infrastructure 4 IOC(s)
50%
Domain
360.net TEMP.Zagros TEMP.Periscope MicrosoftMapping.json
Capability
50%
10 technique(s) 51 tool(s)/malware 1 CVE(s)
Agent Tesla Anubis Athena Aurora BANSHEE BARIUM BLINDINGCAN BeaverTail +43
collection
T1056.001 T1074
command and control
T1105
credential access
T1003
defense impairment
T1112
Victim
70%

Targeted Sectors

financial-services government defense telecommunications manufacturing media chemical non-profit education healthcare legal-services think-tank pharmaceutical transportation hospitality critical-infrastructure information-technology gaming maritime mining utilities energy

Targeted Countries

IR CN RU IL KP IN US VN TR LB KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059.003 T1068

Capability (Malware)

Agent Tesla Anubis Athena
5 Installation

Capability (Techniques)

T1003 T1087

Capability (Malware)

Agent Tesla Anubis Athena
6 Command & Control

Capability (Malware)

Agent Tesla Anubis Athena
7 Actions on Objectives

Capability (Techniques)

T1491.001

Capability (Malware)

Agent Tesla Anubis Athena
Leaving Threaticon

This link opens an external site that isn't part of the platform.