Comprehensive Ransomware Detection for UK Public Healthcare

MITRE Techniques

• [T1078] Valid Accounts – Used via stolen or purchased credentials and RDP/VPN access: ‘stealing or purchasing valid credentials (acting as an initial access broker)’.
• [T1566] Phishing – Phishing emails are frequently used for initial access: ‘phishing emails carrying malware’ and ‘phishing, malicious email attachments’.
• [T1210] Exploitation of Remote Services – Exploiting exposed services and CVEs (e.g., Citrix ADC CVE-2023-3519, Log4Shell) to gain initial access: ‘exploiting a Citrix ADC VPN flaw CVE-2023-3519’ and ‘exploit unpatched vulnerabilities (such as the Log4j “Log4Shell” flaw)’.
• [T1055] Process Injection / Process Hollowing – Used to evade defenses and run malicious code in legitimate processes: ‘Process Hollowing Detected’ and ‘Identifies code injection into legitimate processes’.
• [T1003] OS Credential Dumping – Memory scraping of LSASS using Mimikatz or ProcDump to harvest credentials: ‘dumping LSASS memory, or using tools like Mimikatz or ProcDump to grab user passwords’.
• [T1021] Remote Services (PsExec, RDP, SMB) – Lateral movement using PsExec, RDP, SMB or remote admin tools: ‘move laterally via PsExec, RDP or even remote tools like AnyDesk and TightVNC’.
• [T1071] Application Layer Protocol (C2 with Cobalt Strike) – Use of Cobalt Strike beacons for command-and-control and persistence: ‘use tools like Cobalt Strike beacons for persistence’.
• [T1490] Inhibit System Recovery (Shadow Copy Deletion) – Deleting Volume Shadow Copies to prevent recovery: ‘deleting Volume Shadow Copies to inhibit backups’ and ‘Shadow Copy Deletion Using OS Utilities Detected’.
• [T1112] Modify Registry (Disable Security Tools) – Disabling Windows Defender via registry or other means to evade detection: ‘Windows Defender Antivirus Disable Detected’ and ‘Suspicious Windows Defender Registry Keys Modification’.
• [T1070] Indicator Removal on Host (Event Log Clearing) – Clearing event logs to remove forensic evidence: ‘Eventlog Cleared Detected’ and ‘Triggers on actions like wevtutil used to wipe forensic logs’.
• [T1041] Exfiltration Over C2 Channel / Cloud Storage – Exfiltration to cloud services (Mega, Dropbox) or using rclone: ‘Exfiltration over Cloud Application Detected’ and ‘RClone Utility Execution’.
• [T1486] Data Encrypted for Impact – Ransomware encryption campaigns producing high volumes of file modifications: ‘High Volume of File Modification or Deletion in a Short Span’ and references to AES/ChaCha20/AES+RSA-4096 usage.
• [T1098] Account Manipulation (Scheduled Tasks / Admin Account Creation) – Creation of scheduled tasks or admin accounts for persistence: ‘Scheduled Task Creation Detected’ and ‘Suspicious Admin Account Creation Detected’.