Incident Score: Analysis & Impact (CHI1767917888)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), with evidence including likely through phishing or social engineering tactics, and attack vector such as Phishing, Social Engineering and Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including hijack payroll accounts to redirect direct deposit payments, and unauthorized access to Workday employee profiles. Under the Credential Access tactic, the analysis identified Credentials from Cloud Instance Metadata API (T1552.006) with moderate to high confidence (70%), with evidence including accessed Chipotle’s Workday employee profiles, and targeted Chipotle’s specific instance and Brute Force (T1110) with moderate confidence (50%), supported by evidence indicating unauthorized access to Workday payroll accounts (phishing/social engineering). Under the Collection tactic, the analysis identified Data from Information Repositories (T1213) with high confidence (90%), with evidence including compromised via Workday payroll accounts, and sSN, DOB, account/routing numbers exposed and Data from Local System (T1005) with moderate to high confidence (70%), supported by evidence indicating exposing the personally identifiable information (PII) of employees. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including data breach exposing PII of 33+ employees, and high sensitivity of data (SSN, DOB, account numbers). Under the Impact tactic, the analysis identified Stored Data Manipulation (T1565.001) with moderate confidence (60%), supported by evidence indicating potential direct deposit diversion (financial gain motivation) and Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no details on extent of breach or data manipulation. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including accessed via legitimate Workday payroll accounts, and phishing/social engineering to bypass controls. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.