3am

News

• UK school estate hit by 3AM ransomware in suspected AI-assisted attackBleepingComputer · 3 Nov 2026

MITRE ATT&CK techniques

Execution

• T1569.002 Service Execution 39 Sigma rules

Persistence

• T1136 Create Account 18 Sigma rules
• T1543.003 Windows Service 40 Sigma rules

Privilege Escalation

• T1548.002 Bypass User Account Control 40 Sigma rules

Discovery

• T1018 Remote System Discovery 9 Sigma rules
• T1135 Network Share Discovery 6 Sigma rules
• T1615 Group Policy Discovery 4 Sigma rules

Exfiltration

• T1048 Exfiltration Over Alternative Protocol 17 Sigma rules

Impact

• T1486 Data Encrypted for Impact 14 Sigma rules
• T1490 Inhibit System Recovery 26 Sigma rules

Stealth

• T1070.001 Clear Windows Event Logs
• T1562.004 Disable or Modify System Firewall