Incident Score: Analysis & Impact (PARNAMTEL1773945547)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating inc employs spear phishing...to deploy malware and Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), supported by evidence indicating software vulnerabilities to deploy malware. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating deploy malware that both steals data and encrypts systems. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating unauthorized access to...administrative accounts. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate confidence (60%), supported by evidence indicating access to network infrastructure and administrative accounts. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating exfiltrated nearly 500 GB of data during the breach. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating exfiltrated nearly 500 GB of data (claimed by Inc). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (95%), supported by evidence indicating data encryption such as Yes (ransomware). Under the Defense Evasion tactic, the analysis identified Indicator Removal: Clear Windows Event Logs (T1070.001) with moderate confidence (50%), supported by evidence indicating no evidence of data exfiltration had been found at the time and Virtualization/Sandbox Evasion (T1497) with lower confidence (40%), supported by evidence indicating ransomware group known for targeting...government sectors. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.