HB-03Level 4 · Breach scenarioDBIR: System Intrusion · VERIS: Malware
Ransomware & malware intrusion
- Level 4 · Breach scenario
- 31 signals
- 5 risk domains
A breach in which malicious code runs on a person's device or in the environment they reach, up to encryption, data theft for extortion and backup destruction.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR: System Intrusion · VERIS: Malware
- NIST CSF 2.0
-
- PR.PS-01
- PR.DS-11
- DE.CM-09
- MITRE ATT&CK
-
- T1204
- T1486
- T1490
- T1685
-
2
Sequences
End in this breach scenario.
-
4
Cohorts
Predict it.
-
31
Signals
Feed it.
-
5
Risk domains
Where those signals come from.
Sequences that lead here
2 sequences end here.
Each one is a set of signals in order inside a window. Choose one to watch it play.
SQ-RAN-015 stepsPeak: Stage 4 Suspected
Click to execution
Step 01ATT&CK tactic: Initial Access
Real phish clicked
SE-B-04Clicks links in real phishing
Stage 3Exploited
Step 03ATT&CK tactic: Execution
Suspicious process
EP-B-05Runs suspicious processes or unapproved software
Stage 4Suspected
Step 04ATT&CK tactic: Credential Access
Credential-theft alert
EP-T-04Credential-theft, lateral-movement or privilege-escalation alert on their device
Stage 4Suspected
Step 05ATT&CK tactic: Defense Impairment
EDR tampered
EP-B-01Disables or tampers with EDR
Stage 4Suspected
Click to execution, 5 steps inside 7 days: Real phish clicked (SE-B-04 Clicks links in real phishing, Initial Access, Stage 3 Exploited); then Malicious site (WC-B-01 Visits known-malicious websites, Execution, Stage 3 Exploited); then Suspicious process (EP-B-05 Runs suspicious processes or unapproved software, Execution, Stage 4 Suspected); then Credential-theft alert (EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device, Credential Access, Stage 4 Suspected); then EDR tampered (EP-B-01 Disables or tampers with EDR, Defense Impairment, Stage 4 Suspected). It leads to HB-03 Ransomware & malware intrusion.
-
SQ-RAN-01
Click to execution
- Step 1: Real phish clicked (SE-B-04 Clicks links in real phishing)
- Step 2: Malicious site (WC-B-01 Visits known-malicious websites)
- Step 3: Suspicious process (EP-B-05 Runs suspicious processes or unapproved software)
- Step 4: Credential-theft alert (EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device)
- Step 5: EDR tampered (EP-B-01 Disables or tampers with EDR)
- Breach scenario: HB-03 Ransomware & malware intrusion
-
SQ-RAN-02
Stealer to ransomware
- Step 1: Infostealer on device (EP-T-03 Infostealer indicators on a device they use)
- Step 2: Credentials for sale (IA-T-02 Credentials flagged as compromised)
- Step 3: Login from new geography (IA-B-04 Signs in from unusual contexts)
- Step 4: Backup console access (IA-A-04 Standing access to backup or storage consoles)
- Breach scenario: HB-03 Ransomware & malware intrusion
The definition, in detail
Definition
It is the System Intrusion pattern in the Verizon DBIR and the Malware action in VERIS, and the first stage runs on the device a person uses.
Example
A clicked attachment runs a loader; three days later credentials are dumped, EDR is tampered with, and the backup console is opened.
How it is measured
- Anchor
- DBIR: System Intrusion · VERIS: Malware
- SOC signals
- Malware, EDR detections
- Fed by
- 31 signals across 5 risk domains
How it is used
Programs measure toward Ransomware & malware intrusion by counting the 31 signals, 4 cohorts and 2 sequences that point to it, and tie them to the incidents the SOC records as malware, edr detections.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Ransomware & malware intrusion" (HB-03), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-03-ransomware-and-malware-intrusion
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.