Incident Score: Analysis & Impact (INSRUTUDEHARCOL1782312004)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (95%), with evidence including exploiting SaaS access, federated identities, and operational trust, and free-for-Teacher accounts to pivot into the SaaS platform, Trusted Relationship (T1199) with high confidence (90%), with evidence including vendor compromise now equals institutional compromise, and federated identity risks, and Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (70%), with evidence including downstream phishing and credential-stuffing risks, and iT impersonation and social engineering. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with moderate to high confidence (70%), with evidence including iT impersonation and social engineering, and mFA resets, password changes, or device registrations and Command and Scripting Interpreter (T1059) with moderate confidence (60%), with evidence including aPI-driven access to reduce visibility, and mailbox manipulation (forwarding rules, suppressed security alerts). Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with high confidence (95%), with evidence including identity debt—accumulated credentials from alumni, shared lab access, and unmanaged identities to move laterally, Create Account (T1136) with moderate to high confidence (70%), with evidence including free-for-Teacher accounts exploited to pivot, and temporary research accounts that persist, and Modify Authentication Process (T1556) with moderate to high confidence (80%), with evidence including oAuth abuse (e.g., granting Mail.Read or Files.Read.All permissions), and mFA resets initiated by attackers. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), with evidence including exploiting valid but unmanaged identities, and federated identity exploitation and Abuse Elevation Control Mechanism (T1548) with moderate to high confidence (80%), with evidence including oAuth abuse (e.g., granting elevated permissions), and iT impersonation for MFA resets. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with high confidence (95%), with evidence including attackers operate within systems using legitimate credentials, and no traditional security alerts triggered, Hide Artifacts: Email Hiding Rules (T1564.008) with moderate to high confidence (80%), supported by evidence indicating mailbox manipulation (forwarding rules, suppressed security alerts), and BITS Jobs (T1197) with moderate confidence (60%), with evidence including aPI-driven access to reduce visibility, and cloud platforms (Microsoft 365, Google Workspace). Under the Credential Access tactic, the analysis identified Unsecured Credentials: Cloud Instance Metadata API (T1552.006) with moderate to high confidence (80%), with evidence including saaS as the new intrusion layer (Microsoft 365, Google Workspace), and aPI-driven access, Steal Application Access Token (T1528) with high confidence (90%), with evidence including oAuth abuse (e.g., granting Mail.Read or Files.Read.All permissions), and federated identity exploitation, and Brute Force: Password Spraying (T1110.003) with moderate to high confidence (70%), with evidence including downstream phishing and credential-stuffing risks, and unmanaged credentials. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (80%), with evidence including identity debt—accumulated credentials from alumni, shared lab access, and unmanaged identities and Permission Groups Discovery (T1069) with moderate to high confidence (70%), with evidence including oAuth abuse (e.g., granting elevated permissions), and federated identity risks. Under the Lateral Movement tactic, the analysis identified Valid Accounts (T1078) with high confidence (95%), with evidence including attackers move laterally without triggering alerts, and federated identity exploitation and Use Alternate Authentication Material: Application Access Token (T1550.001) with high confidence (90%), with evidence including oAuth abuse (e.g., granting permissions), and aPI-driven access. Under the Collection tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with moderate to high confidence (80%), with evidence including mailbox manipulation (forwarding rules), and microsoft 365/Google Workspace access, Data from Information Repositories (T1213) with high confidence (90%), with evidence including 3.65TB of data exfiltrated (Canvas), and pII, instructor payout data, corporate details, and Data from Local System (T1005) with moderate to high confidence (70%), with evidence including student/faculty/staff data compromised, and academic records and operational data. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), with evidence including aPI-driven access to reduce visibility, and cloud platforms (Microsoft 365, Google Workspace) and Web Service (T1102) with moderate to high confidence (70%), with evidence including saaS platforms used as intrusion layer, and oAuth abuse for persistence. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including 3.65TB of data exfiltrated (Canvas), and 1.4 million records compromised (Udemy) and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate to high confidence (70%), with evidence including data later indexed by Have I Been Pwned, and cloud platforms as intrusion layer. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (30%), with evidence including ransomwares decline as a primary tool, and prioritize data theft over encryption, Defacement: Internal Defacement (T1491.001) with high confidence (90%), supported by evidence indicating defacing 330 institution login portals (Harvard, Stanford, Columbia, Rutgers), and Service Stop (T1489) with moderate to high confidence (80%), supported by evidence indicating disrupting operations during critical academic periods (finals season). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.