This is assumed we know the name of the process - ransomware_process. If not that needs to be removed from the pattern. Detection of a ransomware process that monopolizes CPU cycles by consuming a high percentage of CPU resources. This process resists termination attempts, effectively holding system resources hostage and degrading spacecraft performance. This could indicate a ransomware variant that demands ransom in exchange for restoring normal system operations by releasing CPU resources.
| ID | Name | Description | |
| EX-0010 | Inject Malicious Code | Threat actors may rely on other tactics and techniques in order to inject malicious code into the victim spacecraft. This can be done via compromising the supply chain or development environment in some capacity or taking advantage of known commands. However, once malicious code has been uploaded to the victim spacecraft, the threat actor can then trigger the code to run via a specific command or wait for a legitimate user to trigger it accidently. The code itself can do a number of different things to the hosted payload, subsystems, or underlying OS. | |