Incident Score: Analysis & Impact (MAN1779107075)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including targeting internet-facing systems, and fortinet systems, Cisco-related exploits and Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including credential abuse, and private chats discussing credential abuse. Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with moderate to high confidence (70%), supported by evidence indicating private chats discussing attack methods and User Execution: Malicious File (T1204.002) with moderate confidence (60%), supported by evidence indicating systemBC malware for persistence and remote access. Under the Persistence tactic, the analysis identified Create or Modify System Process: Windows Service (T1543.003) with moderate to high confidence (70%), supported by evidence indicating systemBC malware for persistence and Create Account (T1136) with moderate confidence (60%), supported by evidence indicating affiliate activity and victim management tools. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating fortinet systems, Cisco-related exploits and Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate confidence (60%), supported by evidence indicating disabling security tools. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with high confidence (90%), with evidence including eDR-killing tools, and disabling security tools, Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating credential abuse, and Use Alternate Authentication Material: Pass the Hash (T1550.002) with moderate to high confidence (70%), supported by evidence indicating nTLM relay attacks. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with moderate to high confidence (70%), supported by evidence indicating credential abuse and OS Credential Dumping (T1003) with moderate confidence (60%), supported by evidence indicating private chats discussing credential abuse. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating victim management tools and File and Directory Discovery (T1083) with moderate confidence (60%), supported by evidence indicating targeting Windows, Linux, NAS, and ESXi environments. Under the Lateral Movement tactic, the analysis identified Use Alternate Authentication Material: Pass the Hash (T1550.002) with moderate to high confidence (70%), supported by evidence indicating nTLM relay attacks and Remote Services: Remote Desktop Protocol (T1021.001) with moderate confidence (60%), supported by evidence indicating access to enterprise networks. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), with evidence including victim data compromised, and over 1,570 likely victims. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating systemBC malware for remote access. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating leaked data included internal systems, victim data. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating encrypting Windows, Linux, NAS, and ESXi environments. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.