Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

shai-hulud (threat actor)

Risk

100

Critical

43 techniques 53 tools/malware 5 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1593

Search Open Websites/Domains reconnaissance

T1593.003

Code Repositories reconnaissance

›

2 Weaponization

T1608

Stage Capabilities resource development

›

3 Delivery

T1195

Supply Chain Compromise initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1106

Native API execution

T1677

Poisoned Pipeline Execution execution

T1546

Event Triggered Execution privilege escalation

T1548

Abuse Elevation Control Mechanism privilege escalation

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-45321

›

5 Installation

T1528

Steal Application Access Token credential access

T1552

Unsecured Credentials credential access

T1552.001

Credentials In Files credential access

T1552.002

Credentials in Registry credential access

T1552.003

Shell History credential access

T1552.004

Private Keys credential access

T1552.005

Cloud Instance Metadata API credential access

T1552.006

Group Policy Preferences credential access

T1552.007

Container API credential access

T1555

Credentials from Password Stores credential access

T1082

System Information Discovery discovery

T1098

Account Manipulation persistence

T1543

Create or Modify System Process persistence

›

6 Command & Control

T1119

Automated Collection collection

T1213

Data from Information Repositories collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1550

Use Alternate Authentication Material lateral movement

›

7 Actions on Objectives

T1553

Subvert Trust Controls defense impairment

T1685

Disable or Modify Tools defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1567.001

Exfiltration to Code Repository exfiltration

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1036.009

Break Process Trees stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T1564

Hide Artifacts stealth

T1574

Hijack Execution Flow stealth

T1678

Delay Execution stealth

Stage risk: Critical High Medium None

Tools & Malware (53)

AADInternals Agent Tesla Azorult Backdoors BlackEnergy Bun Bun runtime C2 infrastructure Carbon Cursor Emotet Empire Explorer GitHub GitHub Actions workflows Global Group Policy Hades Hildegard Hook Kimsuky LaZagne Leverage Miasma Microsoft Defender XDR Mini Shai-Hulud Node.js OilRig Payload Payload PoshC2 PowerShell Pupy Pysa QuasarRAT RedCurl STOP Shai-Hulud Smoke Loader StrelaStealer TeamTNT TrickBot TruffleHog Unknown WildFire XTunnel curl jRAT npm packages phishing pngdowner systemd whoami

Indicators of Compromise (40)

Domain

api.anthropic.com setup.mdc environment.json cloud.json truffleSecrets.json Runner.Listener credentials.Microsoft JS.Malicious.npmpackage +20 more

Filename

setup.js cmd.exe Node.js bundle.js bun.exe Node.JS

SHA-256 Hash

b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09 62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0 f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068 cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

35 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1013 Application Developer Guidance M1047 Audit

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1018 User Account Management M1033 Limit Software Installation M1046 Boot Integrity +1 more

Exploitation (15)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Installation (20)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more

Command & Control (15)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +10 more

Actions on Objectives (26)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +21 more

Detection Coverage

43 strategies

7/7 stages covered

Reconnaissance (2)

DET0805 Detection of Code Repositories DET0856 Detection of Search Open Websites/Domain...

Weaponization (1)

DET0839 Detection of Stage Capabilities

Delivery (1)

DET0537 Behavioral detection for Supply Chain Co...

Exploitation (5)

DET0010 Behavioral Detection of Event Triggered... DET0345 Detection Strategy for Abuse Elevation C... DET0516 Behavioral Detection of Command and Scri... DET0529 Behavioral Detection of Native API Invoc... DET0533 Detection Strategy for Poisoned Pipeline...

Installation (13)

DET0001 Detect Access to Cloud Instance Metadata... DET0096 Account Manipulation Behavior Chain Dete... DET0198 Detect Abuse of Container APIs for Crede... DET0250 Detect Credential Discovery via Windows... DET0307 Detect Access to Unsecured Credential Fi... +8 more

Command & Control (6)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect... DET0338 Behavioral Detection Strategy for Use Al... DET0413 Abuse of Information Repositories for Da... +1 more

Actions on Objectives (15)

DET0127 Behavioral Detection of Masquerading Acr... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0218 Detection Strategy for Hijack Execution... DET0318 Detection Strategy for Exfiltration to C... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

shai-hulud

Type: Unknown Active

tracked as Mini Shai-Hulud a worm

Infrastructure 28 IOC(s)

50%

Domain

api.anthropic.com setup.mdc environment.json cloud.json truffleSecrets.json +23

Artifacts (12)

setup.js cmd.exe Node.js bundle.js bun.exe Node.JS +6

Capability

50%

43 technique(s) 53 tool(s)/malware 5 CVE(s)

AADInternals Agent Tesla Azorult Backdoors BlackEnergy Bun Bun runtime C2 infrastructure +45

collection

T1119 T1213

command and control

T1071 T1071.001 T1105

credential access

T1528 T1552 T1552.001 T1552.002 +6

defense impairment

T1553 T1685

Victim

70%

Targeted Sectors

government defense critical-infrastructure financial-services information-technology oil-gas telecommunications non-profit think-tank

Targeted Countries

US SA KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1593 T1593.003

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

2 Weaponization

Capability (Techniques)

T1608

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

3 Delivery

Capability (Techniques)

T1195

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

4 Exploitation

Capability (Techniques)

T1059 T1106 T1677 T1546 T1548

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

5 Installation

Capability (Techniques)

T1528 T1552 T1552.001 T1552.002 T1552.003

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

6 Command & Control

Capability (Techniques)

T1119 T1213 T1071 T1071.001 T1105

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json

7 Actions on Objectives

Capability (Techniques)

T1041 T1567 T1567.001 T1485 T1486

Capability (Malware)

AADInternals Agent Tesla Azorult

Infrastructure

api.anthropic.com setup.mdc environment.json