Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Volt Typhoon (threat actor)
Risk
69
High
81 techniques 1 tools/malware 0 vulnerabilities 68 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
11
T1589
Gather Victim Identity Information reconnaissance
T1589.002
Email Addresses reconnaissance
T1590
Gather Victim Network Information reconnaissance
T1590.004
Network Topology reconnaissance
T1590.006
Network Security Appliances reconnaissance
T1591
Gather Victim Org Information reconnaissance
T1591.004
Identify Roles reconnaissance
T1592
Gather Victim Host Information reconnaissance
T1593
Search Open Websites/Domains reconnaissance
T1594
Search Victim-Owned Websites reconnaissance
T1596.005
Scan Databases reconnaissance
›
2 Weaponization
7
T1584.003
Virtual Private Server resource development
T1584.004
Server resource development
T1584.005
Botnet resource development
T1584.008
Network Devices resource development
T1587.004
Exploits resource development
T1588.002
Tool resource development
T1588.006
Vulnerabilities resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
5
T1047
Windows Management Instrumentation execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.004
Unix Shell execution
T1068
Exploitation for Privilege Escalation privilege escalation
›
5 Installation
31
T1003.001
LSASS Memory credential access
T1003.003
NTDS credential access
T1552
Unsecured Credentials credential access
T1552.004
Private Keys credential access
T1555
Credentials from Password Stores credential access
T1555.003
Credentials from Web Browsers credential access
T1007
System Service Discovery discovery
T1010
Application Window Discovery discovery
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1016.001
Internet Connection Discovery discovery
T1018
Remote System Discovery discovery
T1033
System Owner/User Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1069
Permission Groups Discovery discovery
T1069.001
Local Groups discovery
T1069.002
Domain Groups discovery
T1083
File and Directory Discovery discovery
T1087.001
Local Account discovery
T1087.002
Domain Account discovery
T1120
Peripheral Device Discovery discovery
T1124
System Time Discovery discovery
T1217
Browser Information Discovery discovery
T1518
Software Discovery discovery
T1614
System Location Discovery discovery
T1654
Log Enumeration discovery
T1680
Local Storage Discovery discovery
T1133
External Remote Services persistence
T1505.003
Web Shell persistence
›
6 Command & Control
13
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1113
Screen Capture collection
T1560.001
Archive via Utility collection
T1090
Proxy command and control
T1090.001
Internal Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1105
Ingress Tool Transfer command and control
T1573.001
Symmetric Cryptography command and control
T1021.001
Remote Desktop Protocol lateral movement
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
13
T1112
Modify Registry defense impairment
T1685.005
Clear Windows Event Logs defense impairment
T1006
Direct Volume Access stealth
T1027.002
Software Packing stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1036.008
Masquerade File Type stealth
T1070.004
File Deletion stealth
T1070.007
Clear Network Connection History and Configurations stealth
T1078
Valid Accounts stealth
T1078.002
Domain Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1497.001
System Checks stealth
Stage risk: Critical High Medium None

Tools & Malware (1)

VersaMem

Indicators of Compromise (68)

Filename
eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 BrightmetricAgent.exe SMSvcService.exe
MD5 Hash
fd41134e8ead1c18ccad27c62a260aa6 b1de37bf229890ac181bdef1ad8ee0c2 3a97d9b6f17754dcd38ca7fc89caab04
SHA-1 Hash
ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 04423659f175a6878b26ac7d6b6e47c6fd9194d1 ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11
SHA-256 Hash
389a497f27e1dd7484325e8e02bbdf656d53d5cf2601514e9b8d8974befddf61 c4b185dbca490a7f93bc96eefb9a597684fdf532d5a04aa4d9b4d4b1552c283b e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95 6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff cd69e8a25a07318b153e01bba74a1ae60f8fc28eb3d56078f448461400baa984 17506c2246551d401c43726bdaec800f8d41595d01311cf38a19140ad32da2f4 8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2 baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c +14 more
SHA-512 Hash
df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973
IPv4 Address
207.154.201.214 157.245.156.7 139.59.254.193 64.227.93.39 159.65.33.216 143.110.199.6 64.225.47.166 51.255.62.13 +26 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (3)
M1013 Application Developer Guidance M1047 Audit M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (11)
M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +6 more
Installation (20)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more
Command & Control (12)
M1018 User Account Management M1020 SSL/TLS Inspection M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +7 more
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +15 more

Detection Coverage

81 strategies
7/7 stages covered

Reconnaissance (11)

DET0807 Detection of Identify Roles DET0810 Detection of Search Victim-Owned Website... DET0814 Detection of Email Addresses DET0819 Detection of Network Topology DET0826 Detection of Gather Victim Host Informat... +6 more

Weaponization (7)

DET0808 Detection of Vulnerabilities DET0852 Detection of Tool DET0854 Detection of Virtual Private Server DET0859 Detection of Network Devices DET0874 Detection of Server +2 more

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex... DET0384 Behavioral Detection of Unix Shell Execu... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Installation (31)

DET0013 Detection of Local Browser Artifact Acce... DET0034 Detection of Adversarial Process Discove... DET0037 Detect Suspicious Access to Browser Cred... DET0043 Detection Strategy for System Location D... DET0093 Behavioral Detection of User Discovery v... +26 more

Command & Control (13)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0089 Behavioral Detection of Keylogging Activ... DET0143 Detection Strategy for Encrypted Channel... +8 more

Actions on Objectives (13)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0049 Behavioral Detection of Network History... DET0081 Detection of Proxy Execution via Trusted... DET0140 Behavioral Detection of Malicious File D... DET0168 Virtualization/Sandbox Evasion via Syste... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
3/4
Adversary
Confidence
90%

Volt Typhoon

Type: Unknown Active
BRONZE SILHOUETTE Vanguard Panda DEV-0391 UNC3236 Voltzite +3 more
Infrastructure 34 IOC(s)
50%
IPv4 Address
207.154.201.214 157.245.156.7 139.59.254.193 64.227.93.39 159.65.33.216 +29
Artifacts (34)
eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 BrightmetricAgent.exe SMSvcService.exe fd41134e8ead1c18ccad27c62a260aa6 b1de37bf229890ac181bdef1ad8ee0c2 3a97d9b6f17754dcd38ca7fc89caab04 +28
Capability
90%
81 technique(s) 1 tool(s)/malware
VersaMem
collection
T1005 T1056.001 T1074 T1074.001 +2
command and control
T1090 T1090.001 T1090.003 T1105 +1
credential access
T1003.001 T1003.003 T1552 T1552.004 +2
defense impairment
T1112 T1685.005
Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

VersaMem
2 Weaponization

Capability (Malware)

VersaMem
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

VersaMem
4 Exploitation

Capability (Malware)

VersaMem
5 Installation

Capability (Malware)

VersaMem
6 Command & Control

Capability (Malware)

VersaMem
Leaving Threaticon

This link opens an external site that isn't part of the platform.