DETECTION OVERVIEW
Risk Factors
The Mythic framework is publicly available and is associated with pen testing, security assessments and known attack campaigns. Mythic provides a web-based user interface that enables an attacker to easily configure or interact with a persistent C&C channel through a web browser. You should examine unusual connections to the Mythic user interface to prevent critical or costly attacks.
Kill Chain
Risk Score
56
Mythic is a post-compromise C&C framework. Mythic includes a web-based user interface that enables users to access and manage the Mythic software. An attacker can generate a Mythic agent, configure C&C traffic with a profile, and issue commands to Mythic agents through the interface.
Quarantine the device while checking for malware.
Block inbound and outbound traffic from suspicious hosts at the network perimeter.
Monitor and investigate unusual network activity for lateral movement or data exfiltration.
Implement network segmentation and the principle of least privilege to minimize the damage caused by a compromised device.