Incident Score: Analysis & Impact (SOU1781714348)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), with evidence including suspicious activity within its email environment, and unauthorized actor had accessed six employee email accounts and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating accessed six employee email accounts. Under the Credential Access tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with moderate to high confidence (80%), supported by evidence indicating unauthorized actor had accessed six employee email accounts and Unsecured Credentials: Email Addresses (T1552.008) with moderate confidence (60%), supported by evidence indicating suspicious activity within its email environment. Under the Collection tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with high confidence (90%), supported by evidence indicating potentially exposed...names, Social Security numbers, contact information, medical records and Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (50%), supported by evidence indicating medical records, and other health-related data. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating data breach impacting 2,316 individuals and Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate confidence (60%), supported by evidence indicating no details on data exfiltration method. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of data destruction and Data Manipulation: Transmitted Data Manipulation (T1565.002) with lower confidence (40%), supported by evidence indicating identity theft risk such as High. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.