SQ-RAN-02Level 3 · Sequence4 steps in 95 days
Stealer to ransomware
- 4 steps
- 95 days
- Level 3 · Sequence
Infostealer indicators appear on a device the person uses, their credentials are flagged as compromised and offered for sale, a sign-in arrives from a new geography, and the account reaches a backup or storage console, all within 95 days.
Classification
- Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Credential Access
- Resource Development
- Initial Access
- Impact
- NIST CSF 2.0 (from its signals)
-
- DE.CM-09
- ID.RA-02
- DE.CM-03
- PR.DS-11
- MITRE ATT&CK (from its signals)
-
- T1555
- T1078
- T1490
The sequence, step by step
SQ-RAN-024 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Credential Access
Infostealer on device
EP-T-03Infostealer indicators on a device they use
Stage 1Exposed
Step 02ATT&CK tactic: Resource Development
Credentials for sale
IA-T-02Credentials flagged as compromised
Stage 1Exposed
Step 03ATT&CK tactic: Initial Access
Login from new geography
IA-B-04Signs in from unusual contexts
Stage 4Suspected
Step 04ATT&CK tactic: Impact
Backup console access
IA-A-04Standing access to backup or storage consoles
Stage 4Suspected
Stealer to ransomware, 4 steps inside 95 days: Infostealer on device (EP-T-03 Infostealer indicators on a device they use, Credential Access, Stage 1 Exposed); then Credentials for sale (IA-T-02 Credentials flagged as compromised, Resource Development, Stage 1 Exposed); then Login from new geography (IA-B-04 Signs in from unusual contexts, Initial Access, Stage 4 Suspected); then Backup console access (IA-A-04 Standing access to backup or storage consoles, Impact, Stage 4 Suspected). It leads to HB-03 Ransomware & malware intrusion.
A completed sequence is evidence that its steps happened in order inside 95 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The stealer and the sale keep the person at Stage 1; the sign-in completes the sequence at Stage 4, and the console access is the step that precedes backup destruction.
Example
A systems administrator's home PC, used for VPN access, matched a stealer log in January; the credentials surfaced on a marketplace in February, and in March a login from abroad opened the backup console.
The steps
4 steps, in order.
-
Infostealer on device
-
Credentials for sale
-
Login from new geography
-
Backup console access
How it is measured
- Steps
- 4
- Window
- 95 days
- Sources
- Breach & dark-web exposure, Identity provider & MFA, IGA, PAM & entitlements
- Breach scenario
- Ransomware & malware intrusion
How it is used
Programs watch the 4 steps in order inside 95 days; a completed run moves the person to Stage 4 Suspected and points at Ransomware & malware intrusion.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Stealer to ransomware" (SQ-RAN-02), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ran-02-stealer-to-ransomware
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
Same breach scenario
One other sequence ends in Ransomware & malware intrusion.
HB-03 Ransomware & malware intrusion: every sequence, cohort and signal that points to it.
-
SQ-RAN-015 steps · 7 days
Click to execution
- Step 1: Real phish clicked (SE-B-04 Clicks links in real phishing)
- Step 2: Malicious site (WC-B-01 Visits known-malicious websites)
- Step 3: Suspicious process (EP-B-05 Runs suspicious processes or unapproved software)
- Step 4: Credential-theft alert (EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device)
- Step 5: EDR tampered (EP-B-01 Disables or tampers with EDR)
- Breach scenario: HB-03 Ransomware & malware intrusion
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.