Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Impact
Platforms: Windows, Linux, macOS, IaaS, Network Devices, Containers, ESXi
Relationship: conceptual and defensive coverage
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
Showing 30 of 33 inferred defensive relationships.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
Modern ransomware is often the final stage of a broader intrusion involving stolen credentials, remote access, privilege escalation, lateral movement, data staging, and backup compromise.
Why it matters
Defense requires reducing initial access, limiting movement, detecting abnormal administration, protecting recovery, and preparing coordinated response.
Practical focus
- Protect privileged and remote access with strong controls
- Segment important systems and backup infrastructure
- Detect unusual credential and administrative activity
- Exercise restoration and decision-making before an event
Common mistakes
- Treating ransomware as only a malware problem
- Assuming paid recovery restores trust
- Rebuilding systems without addressing compromised identities
BMC v0.2.2 cornerstone expansion
Start analysis of Ransomware with the mission or business outcome, then identify assets, identities, data, trust boundaries, dependencies, expected behavior, and credible failure or abuse cases.
Translate those observations into preventive, detective, responsive, and recovery controls. A mature explanation states not only what the concept is, but also how a practitioner demonstrates that it is working under normal, abnormal, and recovery conditions.
Evidence of effective implementation
- Documented ownership, scope, decision criteria, and permitted exceptions.
- Configuration or architectural evidence tied to a clear control objective.
- Operational telemetry showing expected and unexpected behavior.
- Testing that covers normal use, abuse cases, failure, rollback, and recovery.
- Exceptions that are approved, time bounded, monitored, and revisited.
- Lessons learned that result in updated designs, procedures, detections, or training.
Questions for learners
- Which security properties and business outcomes does Ransomware support?
- What assumptions must remain true for the control or process to work safely?
- What could an attacker, insider, failure, or design error do at each trust boundary?
- Which evidence would prove that controls work continuously rather than only on paper?
- How would the organization respond, restore service, and re-establish trust after failure?
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: