Techniques › T1486
T1486 Data Encrypted for Impact
impact — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
16
Sigma rules tagged attack.t1486
15
KEV CVEs mapped here
<p>Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.</p><p>In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR. Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.</p><p>To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").</p><p>In cloud environments, storage objects within compromised accounts may also be encrypted. For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-38831 | RARLAB WinRAR | secondary impact | Mapped | 2023-08-24 |
| CVE-2023-27532 | Veeam Backup & Replication | secondary impact | Mapped | 2023-08-22 |
| CVE-2023-36884 | Microsoft Windows | secondary impact | Stale | 2023-07-17 |
| CVE-2021-45046 | Apache Log4j2 | secondary impact | Mapped | 2023-05-01 |
| CVE-2023-28252 | Microsoft Windows | secondary impact | Mapped | 2023-04-11 |
| CVE-2023-0669 | Fortra GoAnywhere MFT | secondary impact | Mapped | 2023-02-10 |
| CVE-2015-8651 | Adobe Flash Player | secondary impact | Mapped | 2022-05-25 |
| CVE-2022-22947 | VMware Spring Cloud Gateway | secondary impact | Mapped | 2022-05-16 |
| CVE-2009-3960 | Adobe BlazeDS | primary impact | Mapped | 2022-03-07 |
| CVE-2016-1019 | Adobe Flash Player | secondary impact | Mapped | 2022-03-03 |
| CVE-2021-44228 | Apache Log4j2 | secondary impact | Mapped | 2021-12-10 |
| CVE-2021-42258 | BQE BillQuick Web Suite | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-34473 | Microsoft Exchange Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2020-1472 | Microsoft Netlogon | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0215 Detection of Multi-Platform File Encryption for Impact v1.0
AN0602 WindowsHigh-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.Tunable:
FileExtensionTargetFolderTimeWindowCommandLineAN0603 LinuxEncryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.Tunable:FilenamePatternSyscallBurstRateDirectoryTargetedAN0604 macOSUserland or kernel-level ransomware encrypting user files (Documents, Desktop) usingsrm,gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.macos:unifiedlogfile encrypted|new file with .encrypted extension|disk write burst→ DC0061 File ModificationTunable:ExtensionPatternVolumeTargetedAN0605 ESXiRansomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run throughdcui, SSH, or vSphere.Tunable:FileTypeUserContextAN0606 IaaSEncryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.Tunable:SSEHeaderAffectedBucketUserAgent
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1486
Author: frack113
· 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Author: toopricey
· 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Saiprashanth Pulisetti ( @Prashanthblogs)
· 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.
Author: Luc Génaux
· 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: frack113
· 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487
Detects a specific command used by the Conti ransomware group
Author: Vasiliy Burov, oscd.community
· 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068
Detects LockerGoga ransomware activity via specific command line.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Author: Luc Génaux
· 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: austinsonger
· 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Author: frack113
· 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11
Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks.
Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.
Author: frack113
· 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.
Author: j4son
· 2023-05-23 · logsource: product=windows service=security · eee8311f-a752-44f0-bf2f-6b007db16300
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.