Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
TL;DR This analysis documents how the Rhadamanthys malware sends a malformed DoH query with the Host field specified twice. It fails in Any Run tasks that have the MITM Proxy enabled. This behavior could be used for detections. Table of Contents TL;DR Tactical Pause Background Analysis Regular DNS fallback DNS over HTTPS (DoH) RFC Additional Any Run sessions What a successful DoH stream looks like Summary Indicators References Tactical Pause THE CONTENT, VIEWS, AND OPINIONS…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(2)
Victim
Attack Flow4 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | nexus-cloud-360.com | High | Score 58/100 | First seen |
| IP | 2.58.56.54 | High | Score 58/100 | First seen |
| IP | 103.245.231.209 | High | Score 58/100 | First seen |
| IP | 185.141.216.120 | High | Score 58/100 | First seen |
| Domain | age-of-wonders-06-2019.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…