Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Maverick Panda (threat actor)

Risk

High

11 techniques 55 tools/malware 0 vulnerabilities 39 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1204.002

Malicious File execution

T1204.004

Malicious Copy and Paste execution

›

5 Installation

T1003.001

LSASS Memory credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1003.001 LSASS Memory

T1036 Masquerading

T1059.003 PowerShell

T1071.001 Application Layer Protocol: HTTP

T1105 Ingress Tool Transfer

T1140 Deobfuscate/Decode Files or Information

T1204.002 Malicious File

T1204.004 Malicious Copy and Paste

Stage risk: Critical High Medium None

Tools & Malware (55)

Agent.XST Akira Akira ransomware Anchor Athena Aurora BRICKSTORM BRICKSTORM backdoor Backdoor malware Backdoors ClickFix Cobalt Crisis Dark Emotet Expand Gh0StRAT GhostEmperor GitHub Global Grabber Guard Interlock Interlock ransomware Keyhole Keyloggers Kivars Legitimate Software Leverage Malwarebytes Matrix NotPetya NotPetya ransomware OilRig PLAY PlugX Ransomware variants Rootkit SLServer STOP Samurai Sednit SentinelOne Singularity Sofacy Stuxnet Sykipot T9000 TrailBlazer Trojan UP007 XMRIG XMRig Zero-day exploits phishing

Indicators of Compromise (39)

Domain

VfPpkd-OkbHre-SfQLQb-M1Soyc-bN97Pc.VfPpkd running.Find aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-r08add.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-E6eRQd.aqdrmf +30 more

Filename

M.E.Doc

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (5)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Installation (7)

M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +2 more

Detection Coverage

3 strategies

2/7 stages covered

Exploitation (2)

DET0294 User Execution – Malicious File via down... DET0340 User Execution – Malicious Copy & Paste...

Installation (1)

DET0363 Detection of Credential Dumping from LSA...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

70%

Maverick Panda

Type: Nation-State Active

Maverick Panda PLA Navy Sykipot Wisp Team MAVERICK PANDA +15 more

Infrastructure 38 IOC(s)

50%

Domain

VfPpkd-OkbHre-SfQLQb-M1Soyc-bN97Pc.VfPpkd running.Find aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf +33

Artifacts (1)

M.E.Doc

Capability

50%

11 technique(s) 55 tool(s)/malware

Agent.XST Akira Akira ransomware Anchor Athena Aurora BRICKSTORM BRICKSTORM backdoor +47

T1003.001 LSASS Memory T1036 Masquerading T1059.003 PowerShell T1071.001 Application Layer Protocol: HTTP +4

credential access

T1003.001

execution

T1204.002 T1204.004

Victim

70%

Targeted Sectors

government defense critical infrastructure telecommunications financial-services critical-infrastructure manufacturing aviation aerospace information-technology non-profit media nuclear maritime gaming mining oil-gas healthcare energy

Targeted Countries

TW US IR middle_east KR CN DE GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1204.002 T1204.004

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

VfPpkd-OkbHre-SfQLQb-M1Soyc-bN97Pc.VfPpkd running.Find aqdrmf-rymPhb-ibnC6b.aqdrmf

5 Installation

Capability (Techniques)

T1003.001

Capability (Malware)

Agent.XST Akira Akira ransomware

Infrastructure

VfPpkd-OkbHre-SfQLQb-M1Soyc-bN97Pc.VfPpkd running.Find aqdrmf-rymPhb-ibnC6b.aqdrmf