Incident Score: Analysis & Impact (MT.1778106493)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating unauthorized access to the clinic’s systems and Exploit Public-Facing Application (T1190) with lower confidence (40%), supported by evidence indicating attack vector described as Unauthorized access. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate confidence (50%), supported by evidence indicating lOCKBIT 5.0 ransomware strain involved. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (50%), supported by evidence indicating unauthorized access maintained for exfiltration. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (50%), supported by evidence indicating access to sensitive patient data implies elevated privileges. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (60%), supported by evidence indicating lOCKBIT 5.0 ransomware known for encryption/obfuscation and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (50%), supported by evidence indicating ransomware attack implies defense evasion. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate confidence (50%), supported by evidence indicating access to Social Security numbers, health insurance details and Unsecured Credentials: Credentials In Files (T1552.001) with lower confidence (40%), supported by evidence indicating sensitive patient data accessed implies credential exposure. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate confidence (50%), supported by evidence indicating access to patient and health plan beneficiary numbers and Data from Local System (T1005) with moderate confidence (60%), supported by evidence indicating medical treatment and diagnostic records exfiltrated. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating sensitive files were exfiltrated by a third-party actor and Data from Network Shared Drive (T1039) with moderate confidence (60%), supported by evidence indicating healthcare provider’s systems accessed for patient data. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed by forensic investigations and Exfiltration Over Web Service (T1567) with moderate to high confidence (70%), supported by evidence indicating threatened to publish stolen data on the dark web. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (80%), supported by evidence indicating lOCKBIT 5.0 ransomware strain involved and Inhibit System Recovery (T1490) with moderate confidence (60%), supported by evidence indicating ransomware attack implies disruption of recovery. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.