Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Aoqin Dragon (threat actor)

Risk

Medium

9 techniques 2 tools/malware 0 vulnerabilities 0 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

No data

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

›

5 Installation

T1083

File and Directory Discovery discovery

›

6 Command & Control

T1091

Replication Through Removable Media lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1027.002

Software Packing stealth

T1036

Masquerading stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

Heyoka Backdoor Mongall

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

16 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (6)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more

Command & Control (5)

M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

9 strategies

5/7 stages covered

Weaponization (2)

DET0852 Detection of Tool DET0872 Detection of Malware

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down...

Installation (1)

DET0370 Recursive Enumeration of Files and Direc...

Command & Control (2)

DET0183 Detection Strategy for Lateral Tool Tran... DET0301 Removable Media Execution Chain Detectio...

Actions on Objectives (2)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

Aoqin Dragon

Type: Unknown Active

UNC94

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

9 technique(s) 2 tool(s)/malware

Heyoka Backdoor Mongall

discovery

T1083

execution

T1203 T1204.002

lateral movement

T1091 T1570

resource development

T1587.001 T1588.002

Victim

70%

Targeted Sectors

government education telecommunications

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587.001 T1588.002

Capability (Malware)

Heyoka Backdoor Mongall

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1203 T1204.002

Capability (Malware)

Heyoka Backdoor Mongall

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1083

Capability (Malware)

Heyoka Backdoor Mongall

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1091 T1570

Capability (Malware)

Heyoka Backdoor Mongall

Infrastructure

No infra linked