This chapter is from the book
This chapter is from the book
This chapter is from the book
3.4 Appraisal
Once inside a victim’s environment, adversaries often explore and identify any valuable data. This can include information that is useful for the following purposes:
Applying pressure in extortion: The adversary can use regulated data such as electronic protected health information (ePHI) or Social Security numbers to remind the victim of the potential for fines, regulatory investigation, or other government actions. In some cases, victims may store direct contact information for data subjects, whom adversaries can contact and attempt to intimidate.
Setting a ransom demand: Financial details and cyber insurance coverage can inform the amount of the adversary’s ransom demand.
Sale: Intellectual property and personally identifiable information (PII) are valuable information that can be sold to third parties.
The adversary may update their attack strategy based on these findings. This may include determining whether to install ransomware, identifying information to exfiltrate, setting a ransom demand, and more.
Opportunities for Detection
Look for the following indicators that an adversary may be appraising your infrastructure (among others):
Unexpected or unauthorized access to files. Typically this is identified using third-party security software or security information and event management (SIEM) conditional alerting.
Last read/modified dates on files that are more recent than expected.
Forwarded or copied emails containing information about insurance coverage, finances, and so on.