Incident Score: Analysis & Impact (AOPALLWES1790001577)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), supported by evidence indicating unauthorized activity...ongoing since March in C-Track case management software and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating breach at West Publishing...compromised personal information across multiple courts. Under the Credential Access tactic, the analysis identified Credentials In Files (T1552.001) with moderate to high confidence (70%), supported by evidence indicating confidential, redacted, or sealed court records were also compromised and OS Credential Dumping (T1003) with moderate confidence (50%), supported by evidence indicating social Security numbers, driver’s license numbers exposed. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating names, SSNs, medical info, DOBs, health insurance details compromised and Data from Information Repositories (T1213) with high confidence (90%), supported by evidence indicating c-Track case management software used by courts was compromised. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating unauthorized activity detected on June 30, ongoing since March and Transfer Data to Cloud Account (T1537) with moderate confidence (50%), supported by evidence indicating no evidence of fraud or misuse; third-party experts engaged. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no disruption to C-Track’s operations; systems remain secure and Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating confidential, redacted, or sealed court records compromised. Under the Defense Evasion tactic, the analysis identified Indicator Removal on Host: Clear Windows Event Logs (T1070.001) with moderate confidence (50%), supported by evidence indicating unauthorized activity ongoing since March, detected only on June 30 and Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate confidence (60%), supported by evidence indicating breach disclosed on September 2, months after detection. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.