MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

Improved descriptions

pull/230/head
matthijsvp 2022-02-16 13:09:51 +01:00
parent aaf3a6e36b
commit 6e2195e524
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ransomware-roles/machinetag.json
View File

@ -15,12 +15,12 @@
{ {
"value": "2 - Ransomware Affiliate", "value": "2 - Ransomware Affiliate",
"expanded": "2 - Ransomware Affiliate", "expanded": "2 - Ransomware Affiliate",
"description": "Ransomware Affiliates obtain persistance. They reconnaissance the network of the victim, and make use of lateral movement and privilege escalation to move to points of interest. Once such points are found, ransomware is deployed. Ransomware Affiliates can make use of different ransomware families in different attacks." "description": "Ransomware affiliates are responsible for obtaining control of a victim's network and monetizing it. They perform reconnaissance of the network as well as privilege escalation, and are responsible for destroying any backup options and deployment of ransomware. Ransomware Affiliates can make use of different ransomware families in different attacks."
}, },
{ {
"value": "3 - Data Manager", "value": "3 - Data Manager",
"expanded": "3 - Data Manager", "expanded": "3 - Data Manager",
"description": "Data managers handle the excfiltration of data, and after that, the exfiltrated data itself." "description": "Data managers are responsible for exfiltrating data as well as managing and leaking that exfiltrated data when necessary."
}, },
{ {
"value": "4 - Ransomware Operator", "value": "4 - Ransomware Operator",
@ -30,12 +30,12 @@
{ {
"value": "5 - Negotiator", "value": "5 - Negotiator",
"expanded": "5 - Negotiator", "expanded": "5 - Negotiator",
"description": "Negotiations are often performed by a separate actor." "description": "Negotiators are responsible for interacting with the victim and coming to an agreement with the victim regarding the ransom payment."
}, },
{ {
"value": "6 - Chaser", "value": "6 - Chaser",
"expanded": "6 - Chaser", "expanded": "6 - Chaser",
"description": "Chasers put pressure on victims by emailing and calling key employees, to threaten them with continued attacks or publication of confidential data if the ransom is not payed." "description": "Chasers put pressure on the victim by emailing and calling key employee. Chasers threaten these employees with continued attacks or publication of confidential data if the ransom is not payed."
}, },
{ {
"value": "7 - Accountant", "value": "7 - Accountant",