Data/ThreatActorProfiles.json
|
{
"version": "2.1.0", "description": "Threat actor profiles relevant to K-12 and education environments. Maps actor TTPs to PSGuerrilla detection indicators and MITRE ATT&CK techniques.", "profiles": [ { "id": "TA-EDU-001", "name": "Credential Harvesters", "description": "Actors who target education staff via phishing to harvest credentials. Often impersonate ed-tech platforms, district admin, or IT support. Primary goal is initial access for BEC or data theft.", "targetSectors": ["K-12", "Higher Education"], "sophistication": "Low", "motivation": "Financial", "ttps": { "mitre": ["T1566.001", "T1566.002", "T1078.004", "T1114.002", "T1534"], "indicators": ["knownAttackerIp", "bruteForceSuccess", "reauthFromCloud", "emailForwardingRule"], "description": "Phishing emails leading to credential harvest pages. Successful access followed by email forwarding rule creation to intercept password resets and maintain persistence." }, "matchCriteria": { "requiredIndicators": ["bruteForceSuccess"], "optionalIndicators": ["emailForwardingRule", "reauthFromCloud", "knownAttackerIp"], "minOptionalMatch": 1, "minThreatScore": 55 } }, { "id": "TA-EDU-002", "name": "Ransomware Operators", "description": "Groups targeting school districts with ransomware. Exploit weak authentication and unpatched systems for initial access, then move laterally through AD to deploy ransomware domain-wide.", "targetSectors": ["K-12", "Municipal Government"], "sophistication": "Medium", "motivation": "Financial", "ttps": { "mitre": ["T1078.002", "T1078.004", "T1021.001", "T1486", "T1490", "T1047"], "indicators": ["bruteForceSuccess", "adminPrivilegeEscalation", "knownAttackerIp", "concurrentSessions"], "description": "Brute force or credential stuffing for initial access, privilege escalation to domain admin, lateral movement via RDP/WMI, shadow copy deletion, and ransomware deployment." }, "matchCriteria": { "requiredIndicators": ["adminPrivilegeEscalation"], "optionalIndicators": ["bruteForceSuccess", "knownAttackerIp", "concurrentSessions"], "minOptionalMatch": 1, "minThreatScore": 60 } }, { "id": "TA-EDU-003", "name": "Student Data Exfiltrators", "description": "Actors targeting student PII (names, SSNs, grades, IEPs, health records) for identity theft or sale on dark markets. May be external attackers or compromised insider accounts.", "targetSectors": ["K-12"], "sophistication": "Low-Medium", "motivation": "Financial / Identity Theft", "ttps": { "mitre": ["T1078.004", "T1530", "T1567", "T1114.002", "T1213"], "indicators": ["bulkFileDownload", "driveExternalSharing", "emailForwardingRule", "domainWideDelegation"], "description": "Compromise cloud accounts, then bulk download student records from Drive/SharePoint, create external sharing links, or set up email forwarding to exfiltrate data." }, "matchCriteria": { "requiredIndicators": ["bulkFileDownload"], "optionalIndicators": ["driveExternalSharing", "emailForwardingRule", "domainWideDelegation"], "minOptionalMatch": 0, "minThreatScore": 40 } }, { "id": "TA-EDU-004", "name": "OAuth Abusers", "description": "Actors who trick users into granting OAuth permissions to malicious or over-permissioned applications. In K-12, often disguised as educational tools or classroom apps to bypass teacher suspicion.", "targetSectors": ["K-12", "Higher Education"], "sophistication": "Medium", "motivation": "Espionage / Data Access", "ttps": { "mitre": ["T1550.001", "T1528", "T1098.003"], "indicators": ["highRiskOAuthApp", "oauthFromCloud", "domainWideDelegation", "driveExternalSharing"], "description": "Consent phishing via fake ed-tech app OAuth flows. Once granted, app tokens provide persistent access to mailbox, Drive, and directory data without credential theft." }, "matchCriteria": { "requiredIndicators": ["highRiskOAuthApp"], "optionalIndicators": ["oauthFromCloud", "domainWideDelegation", "driveExternalSharing"], "minOptionalMatch": 0, "minThreatScore": 55 } }, { "id": "TA-EDU-005", "name": "BEC / Wire Fraud Actors", "description": "Business email compromise targeting school district finance departments. Impersonate superintendents, vendors, or construction contractors to redirect payments.", "targetSectors": ["K-12", "Municipal Government"], "sophistication": "Medium", "motivation": "Financial", "ttps": { "mitre": ["T1566.001", "T1078.004", "T1114.002", "T1534", "T1656"], "indicators": ["reauthFromCloud", "emailForwardingRule", "knownAttackerIp", "impossibleTravel"], "description": "Compromise finance staff email via phishing, set up mail rules to hide replies, then send fraudulent payment instructions impersonating trusted vendors." }, "matchCriteria": { "requiredIndicators": ["emailForwardingRule"], "optionalIndicators": ["reauthFromCloud", "knownAttackerIp", "impossibleTravel"], "minOptionalMatch": 1, "minThreatScore": 60 } }, { "id": "TA-EDU-006", "name": "Insider Threat — Admin Abuse", "description": "IT administrators or staff with elevated privileges who abuse access to student/employee data, modify grades, or sabotage systems. May be disgruntled employees or contractors.", "targetSectors": ["K-12", "Higher Education"], "sophistication": "Low", "motivation": "Personal / Retaliatory", "ttps": { "mitre": ["T1078.003", "T1098", "T1070.001", "T1485", "T1529"], "indicators": ["adminPrivilegeEscalation", "workspaceSettingChange", "twoSvDisablement", "bulkFileDownload"], "description": "Legitimate admin credentials used to escalate privileges, disable security controls (2SV, audit logging), download bulk data, or modify critical workspace settings." }, "matchCriteria": { "requiredIndicators": ["workspaceSettingChange"], "optionalIndicators": ["adminPrivilegeEscalation", "twoSvDisablement", "bulkFileDownload"], "minOptionalMatch": 1, "minThreatScore": 35 } }, { "id": "TA-EDU-007", "name": "Account Takeover — Cloud Proxy", "description": "Sophisticated actors using cloud infrastructure (AWS, GCP, Azure VMs) to proxy stolen credential access, avoiding IP-based detection. Common in targeted attacks against education.", "targetSectors": ["K-12", "Higher Education", "General"], "sophistication": "High", "motivation": "Espionage / Financial", "ttps": { "mitre": ["T1078.004", "T1090.002", "T1538", "T1114.002"], "indicators": ["reauthFromCloud", "riskyActionFromCloud", "newDeviceFromCloud", "oauthFromCloud", "impossibleTravel"], "description": "Attacker uses compromised credentials from cloud proxy IPs. Initial access via cloud, followed by sensitive actions (mail read, Drive access, admin changes) all from hosting provider addresses." }, "matchCriteria": { "requiredIndicators": ["reauthFromCloud"], "optionalIndicators": ["riskyActionFromCloud", "newDeviceFromCloud", "oauthFromCloud", "impossibleTravel"], "minOptionalMatch": 1, "minThreatScore": 60 } } ] } |