SQ-RAN-01Level 3 · Sequence5 steps in 7 days
Click to execution
- 5 steps
- 7 days
- Level 3 · Sequence
The person clicks a real phishing link, lands on a known-malicious site, a suspicious process runs on their device, endpoint protection raises a credential-theft or lateral-movement alert, and EDR is tampered with, all within 7 days.
Classification
- Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Initial Access
- Execution
- Credential Access
- Defense Impairment
- NIST CSF 2.0 (from its signals)
-
- DE.CM-03
- DE.CM-01
- DE.CM-09
- PR.PS-01
- MITRE ATT&CK (from its signals)
-
- T1204.001
- T1189
- T1204
- T1003
- T1021
- T1068
- T1685
The sequence, step by step
SQ-RAN-015 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Initial Access
Real phish clicked
SE-B-04Clicks links in real phishing
Stage 3Exploited
Step 03ATT&CK tactic: Execution
Suspicious process
EP-B-05Runs suspicious processes or unapproved software
Stage 4Suspected
Step 04ATT&CK tactic: Credential Access
Credential-theft alert
EP-T-04Credential-theft, lateral-movement or privilege-escalation alert on their device
Stage 4Suspected
Step 05ATT&CK tactic: Defense Impairment
EDR tampered
EP-B-01Disables or tampers with EDR
Stage 4Suspected
Click to execution, 5 steps inside 7 days: Real phish clicked (SE-B-04 Clicks links in real phishing, Initial Access, Stage 3 Exploited); then Malicious site (WC-B-01 Visits known-malicious websites, Execution, Stage 3 Exploited); then Suspicious process (EP-B-05 Runs suspicious processes or unapproved software, Execution, Stage 4 Suspected); then Credential-theft alert (EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device, Credential Access, Stage 4 Suspected); then EDR tampered (EP-B-01 Disables or tampers with EDR, Defense Impairment, Stage 4 Suspected). It leads to HB-03 Ransomware & malware intrusion.
A completed sequence is evidence that its steps happened in order inside 7 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The click and the site visit place the person at Stage 3; the suspicious process completes the sequence at Stage 4.
Example
A project manager opened a fake invoice link on Monday; by Wednesday the laptop was running an unsigned binary and the EDR flagged credential dumping, and on Thursday the agent's tamper protection was switched off.
The steps
5 steps, in order.
-
Real phish clicked
-
Malicious site
-
Suspicious process
-
Credential-theft alert
EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device
-
EDR tampered
How it is measured
- Steps
- 5
- Window
- 7 days
- Sources
- Email security, Web, CASB & DLP, Endpoint protection
- Breach scenario
- Ransomware & malware intrusion
How it is used
Programs watch the 5 steps in order inside 7 days; a completed run moves the person to Stage 4 Suspected and points at Ransomware & malware intrusion.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Click to execution" (SQ-RAN-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ran-01-click-to-execution
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
Same breach scenario
One other sequence ends in Ransomware & malware intrusion.
HB-03 Ransomware & malware intrusion: every sequence, cohort and signal that points to it.
-
SQ-RAN-024 steps · 95 days
Stealer to ransomware
- Step 1: Infostealer on device (EP-T-03 Infostealer indicators on a device they use)
- Step 2: Credentials for sale (IA-T-02 Credentials flagged as compromised)
- Step 3: Login from new geography (IA-B-04 Signs in from unusual contexts)
- Step 4: Backup console access (IA-A-04 Standing access to backup or storage consoles)
- Breach scenario: HB-03 Ransomware & malware intrusion
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.