Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Mustard Tempest (threat actor)

Risk

High

12 techniques 3 tools/malware 0 vulnerabilities 0 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.004

Server resource development

T1583.008

Malvertising resource development

T1584.001

Domains resource development

T1608.001

Upload Malware resource development

T1608.004

Drive-by Target resource development

T1608.006

SEO Poisoning resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1204.001

Malicious Link execution

›

5 Installation

T1082

System Information Discovery discovery

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

Stage risk: Critical High Medium None

Tools & Malware (3)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Indicators of Compromise (0)

None linked.

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1048 Application Isolation and Sandboxing +3 more

Exploitation (3)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (3)

M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing

Detection Coverage

12 strategies

6/7 stages covered

Weaponization (6)

DET0824 Detection of Upload Malware DET0825 Detection of Drive-by Target DET0836 Detection of Malvertising DET0863 Detection of Domains DET0871 Detection of Server +1 more

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0066 User Execution – Malicious Link (click →...

Installation (1)

DET0525 System Discovery via Native and Remote U...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0347 Detection Strategy for Masquerading via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

2/4

Adversary

Confidence

90%

Mustard Tempest

Type: Unknown Active

DEV-0206 TA569 GOLD PRELUDE UNC1543 Purple Vallhund

Infrastructure 0 IOC(s)

No infrastructure indicators linked.

Capability

90%

12 technique(s) 3 tool(s)/malware

Cobalt Strike Cobalt Strike - S0154 SocGholish

command and control

T1105

discovery

T1082

execution

T1204.001

initial access

T1189 T1566.002

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.004 T1583.008 T1584.001 T1608.001 T1608.004

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1189 T1566.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1204.001

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1082

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 SocGholish

Infrastructure

No infra linked