Incident Score: Analysis & Impact (ZOH1776249079)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), with evidence including initial access via phishing, and phishing campaign to divert verification messages, Password Spraying (T1110.003) with moderate to high confidence (80%), supported by evidence indicating initial access via...password spraying, and Use Alternate Authentication Material: Application Access Token (T1550.001) with moderate to high confidence (80%), with evidence including compromised OAuth tokens, and stolen session tokens or PowerShell scripts. Under the Persistence tactic, the analysis identified Account Manipulation: Exchange Email Delegate Permissions (T1098.002) with high confidence (90%), with evidence including malicious mailbox rules...persist unless manually removed, and backdoors established such as Malicious mailbox rules and Office Application Startup: Outlook Rules (T1137.005) with high confidence (95%), with evidence including create malicious mailbox rules to manipulate email flow, and rules automatically delete, forward, or redirect messages. Under the Defense Evasion tactic, the analysis identified Hide Artifacts: Email Hiding Rules (T1564.008) with high confidence (90%), with evidence including move emails...to hidden folders like *Archive* or *RSS Subscriptions*, and disguise these rules with innocuous names (e.g., “.”, “..”) and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), with evidence including after gaining initial access via...compromised OAuth tokens, and bypassing the need for credentials once tokens are compromised. Under the Collection tactic, the analysis identified Email Collection: Remote Email Collection (T1114.002) with high confidence (95%), with evidence including silently exfiltrate emails, and intercept financial communications, block security warnings and Data from Local System (T1005) with moderate to high confidence (70%), supported by evidence indicating emails containing financial communications, security alerts, and transaction threads. Under the Exfiltration tactic, the analysis identified Exfiltration Over Alternative Protocol: Email Protocols (T1048.003) with high confidence (90%), with evidence including auto-forwarding...to silently exfiltrate emails, and data exfiltration such as Yes (silent email forwarding/redirection). Under the Command and Control tactic, the analysis identified Ingress Tool Transfer (T1105) with moderate confidence (60%), supported by evidence indicating tools like *ATOLS* enabling attackers to deploy malicious rules. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating hijack a vendor payment thread, redirecting funds to attacker-controlled accounts and Data Manipulation: Transmitted Data Manipulation (T1565.002) with moderate to high confidence (80%), supported by evidence indicating manipulate email flow...to hijack transaction threads without raising suspicion. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.