Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Mustang Panda (threat actor)
Risk
88
Critical
107 techniques 60 tools/malware 1 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1593
Search Open Websites/Domains reconnaissance
T1598.003
Spearphishing Link reconnaissance
›
2 Weaponization
15
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.006
Web Services resource development
T1585
Establish Accounts resource development
T1585.002
Email Accounts resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
T1588.003
Code Signing Certificates resource development
T1588.004
Digital Certificates resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
3
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
16
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1059.007
JavaScript execution
T1072
Software Deployment Tools execution
T1106
Native API execution
T1129
Shared Modules execution
T1203
Exploitation for Client Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1546
Event Triggered Execution privilege escalation
T1546.003
Windows Management Instrumentation Event Subscription privilege escalation
CVE CVE-2017-0199
›
5 Installation
22
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1003.003
NTDS credential access
T1003.006
DCSync credential access
T1557
Adversary-in-the-Middle credential access
T1016
System Network Configuration Discovery discovery
T1018
Remote System Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1069
Permission Groups Discovery discovery
T1069.002
Domain Groups discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1087.002
Domain Account discovery
T1518
Software Discovery discovery
T1654
Log Enumeration discovery
T1176.002
IDE Extensions persistence
T1505.003
Web Shell persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
19
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1119
Automated Collection collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1560.003
Archive via Custom Method collection
T1001
Data Obfuscation command and control
T1001.003
Protocol or Service Impersonation command and control
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1095
Non-Application Layer Protocol command and control
T1102
Web Service command and control
T1105
Ingress Tool Transfer command and control
T1219.001
IDE Tunneling command and control
T1219.002
Remote Desktop Software command and control
T1572
Protocol Tunneling command and control
T1573
Encrypted Channel command and control
T1573.001
Symmetric Cryptography command and control
T1091
Replication Through Removable Media lateral movement
›
7 Actions on Objectives
31
T1553.002
Code Signing defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol exfiltration
T1052
Exfiltration Over Physical Medium exfiltration
T1052.001
Exfiltration over USB exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1027
Obfuscated Files or Information stealth
T1027.007
Dynamic API Resolution stealth
T1027.012
LNK Icon Smuggling stealth
T1027.016
Junk Code Insertion stealth
T1036
Masquerading stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1036.007
Double File Extension stealth
T1036.008
Masquerade File Type stealth
T1070
Indicator Removal stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1205
Traffic Signaling stealth
T1218.004
InstallUtil stealth
T1218.005
Mshta stealth
T1480
Execution Guardrails stealth
T1564
Hide Artifacts stealth
T1564.001
Hidden Files and Directories stealth
T1574
Hijack Execution Flow stealth
T1574.001
DLL stealth
T1574.005
Executable Installer File Permissions Weakness stealth
T1622
Debugger Evasion stealth
T1678
Delay Execution stealth
Stage risk: Critical High Medium None

Tools & Malware (60)

AdFind Akira BOOKWORM Backdoors BlackCat CANONSTAGER CLAIMLOADER Camaro Dragon China Chopper Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 CorKLOG Custom malware Dark GitHub Global HIUPAN HoneyMyte Horse Shell Impacket Jackal Kimsuky Medusa Mimikatz Naikon Nexus Octopus OilRig PAKLOG PHPsert PLAY PUBLOAD Payload Phishing campaigns PlugX Poison Ivy PoisonIvy PowerShell RCSession Rootkit STATICPLUGIN STOP ShadowPad SnakeDisk Spear-phishing SplatCloak SplatDropper StarProxy TONESHELL Trojan Visual Studio Code Web Shells Wevtutil Wicked Windows Command Shell Winnti mim221 phishing

Indicators of Compromise (40)

Domain
TEMP.HEX TEMP.Hex index.php TEMP.Hermit Temp.Hex euw.devtunnels.ms SoftwareUpgradeRpm.htm NTDS.dit +6 more
Filename
wsx.exe getHashFlsa64.dll AddSecurityPackage64.dll local.exe do.exe do.bat pc.dll cmd.exe +12 more
MD5 Hash
2ddea77933e345319f335529d35b6c1a
IPv4 Address
146.70.161.78 185.76.78.117 4.232.170.137 20.103.221.187 8.8.8.8

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (4)
M1013 Application Developer Guidance M1017 User Training M1047 Audit M1054 Software Configuration
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (21)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +16 more
Installation (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +14 more
Command & Control (12)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1029 Remote Data Storage M1030 Network Segmentation M1031 Network Intrusion Prevention +7 more
Actions on Objectives (25)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +20 more

Detection Coverage

107 strategies
7/7 stages covered

Reconnaissance (2)

DET0856 Detection of Search Open Websites/Domain... DET0878 Detection of Spearphishing Link

Weaponization (15)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0839 Detection of Stage Capabilities DET0848 Detection of Digital Certificates DET0850 Detection of Obtain Capabilities +10 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (15)

DET0010 Behavioral Detection of Event Triggered... DET0018 Behavior-chain, platform-aware detection... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0086 Detect WMI Event Subscription for Persis... +10 more

Installation (22)

DET0034 Detection of Adversarial Process Discove... DET0129 Domain Account Enumeration Across Platfo... DET0179 Behavioral Detection of Permission Group... DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... +17 more

Command & Control (19)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0053 Detect Obfuscated C2 via Network Traffic... DET0060 Detect Ingress Tool Transfers via Behavi... DET0133 IDE Tunneling Detection via Process, Fil... +14 more

Actions on Objectives (31)

DET0032 Detection Strategy for Hidden Files and... DET0038 Detection Strategy for Hijack Execution... DET0091 Detection Strategy for Dynamic API Resol... DET0123 Detection of Data Exfiltration via Remov... DET0127 Behavioral Detection of Masquerading Acr... +26 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
70%

Mustang Panda

Type: Nation-State Active
HoneyMyte Temp.Hex BRONZE PRESIDENT Red Lich BASIN +103 more
Infrastructure 19 IOC(s)
50%
Domain
TEMP.HEX TEMP.Hex index.php TEMP.Hermit Temp.Hex +9
IPv4 Address
146.70.161.78 185.76.78.117 4.232.170.137 20.103.221.187 8.8.8.8
Artifacts (21)
wsx.exe getHashFlsa64.dll AddSecurityPackage64.dll local.exe do.exe do.bat +15
Capability
82%
107 technique(s) 60 tool(s)/malware 1 CVE(s)
AdFind Akira BOOKWORM Backdoors BlackCat CANONSTAGER CLAIMLOADER Camaro Dragon +52
collection
T1074 T1074.001 T1119 T1560 +2
command and control
T1001 T1001.003 T1071 T1071.001 +8
credential access
T1003 T1003.001 T1003.003 T1003.006 +1
defense impairment
T1553.002
Victim
70%

Targeted Sectors

government ngo financial-services defense telecommunications healthcare critical-infrastructure education manufacturing non-profit energy media aviation think-tank hospitality aerospace pharmaceutical maritime retail gaming transportation utilities information-technology legal-services mining chemical nuclear entertainment oil-gas construction

Targeted Countries

British Indian Ocean Territory India CN US RU IN IR VN TW AU PK UA JP IL GB KR SA AE KP SG DE TR BY BR MX ES PL CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1593 T1598.003

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
2 Weaponization

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
4 Exploitation

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
5 Installation

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
6 Command & Control

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
7 Actions on Objectives

Capability (Malware)

AdFind Akira BOOKWORM

Infrastructure

TEMP.HEX TEMP.Hex index.php
Leaving Threaticon

This link opens an external site that isn't part of the platform.