Incident Score: Analysis & Impact (TRI1778006158)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating unauthorized access to an employee email account and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating employee email account compromised. Under the Credential Access tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with moderate to high confidence (80%), supported by evidence indicating unauthorized access to an employee email account and Unsecured Credentials: Email Addresses (T1552.008) with moderate to high confidence (70%), supported by evidence indicating employee email account compromised. Under the Collection tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with high confidence (90%), supported by evidence indicating pHI and PII may have been accessible via email and Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (50%), supported by evidence indicating medical records and health insurance information exposed. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate confidence (60%), supported by evidence indicating no evidence the exposed data has been viewed or misused (implied exfil risk) and Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate confidence (50%), supported by evidence indicating employee email account access suggests potential exfiltration. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of misuse, but high-risk data exposed and Data Manipulation: Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating pHI and PII compromised; potential for misuse. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.