Incident Score: Analysis & Impact (JBSKASCOL1773505774)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), with evidence including unsecured RDP, and unpatched legacy systems, Phishing (T1566) with high confidence (90%), supported by evidence indicating 75% of ransomware breaches originate from phishing emails, Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including rDP compromises, and lack of MFA for critical assets, and Exploitation of Remote Services (T1210) with moderate to high confidence (80%), supported by evidence indicating remote Desktop Protocol (RDP) compromises. Under the Execution tactic, the analysis identified User Execution (T1204) with moderate to high confidence (70%), supported by evidence indicating 60% of malware is installed via desktop-sharing apps and Command and Scripting Interpreter (T1059) with moderate confidence (60%), supported by evidence indicating disabling command-line capabilities recommended. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including active Directory vulnerabilities, and lack of MFA and External Remote Services (T1133) with moderate to high confidence (70%), with evidence including rDP compromises, and desktop-sharing apps. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), with evidence including active Directory vulnerabilities, and unsecured RDP and Exploitation for Privilege Escalation (T1068) with moderate confidence (60%), supported by evidence indicating unpatched legacy systems. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including lack of MFA, and rDP compromises, Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating disabling command-line capabilities recommended, and Obfuscated Files or Information (T1027) with moderate confidence (50%), supported by evidence indicating prolonged dwell time attacks. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with moderate to high confidence (70%), supported by evidence indicating unsecured RDP with weak passwords and Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including rDP compromises, and active Directory vulnerabilities. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating hackers lurk undetected to identify high-value data and File and Directory Discovery (T1083) with moderate confidence (60%), supported by evidence indicating prolonged dwell time attacks. Under the Lateral Movement tactic, the analysis identified Remote Services (T1021) with moderate to high confidence (80%), with evidence including rDP compromises, and desktop-sharing apps and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating active Directory vulnerabilities. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating high-value data identified during dwell time and Data from Network Shared Drive (T1039) with moderate confidence (60%), supported by evidence indicating operational data compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating tCP port 445 blocking recommended and Proxy (T1090) with moderate confidence (50%), supported by evidence indicating prolonged dwell time attacks. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed in ransomware attacks and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating supply-chain attacks rose 42% in Q1 2021. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating data encryption confirmed in ransomware attacks, Service Stop (T1489) with moderate to high confidence (80%), with evidence including hard shutdowns by attackers, and 21 days average downtime, and Inhibit System Recovery (T1490) with moderate to high confidence (70%), supported by evidence indicating complicates restoration efforts. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.