T1486: Data Encrypted for Impact

Data from MITRE ATT&CK®:

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)

In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files.(Citation: CarbonBlack Conti July 2020) In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)

To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").(Citation: NHS Digital Egregor Nov 2020)

In cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1)

© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Behavior Prevention on Endpoint

Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Data Backup

Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.

Cloud Storage Modification (Cloud Storage)

Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)

Cloud Storage Metadata (Cloud Storage)

Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner

File Creation (File)

Initial construction of a new file (ex: Sysmon EID 11)

File Modification (File)

Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)

Network Share Access (Network Share)

Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)

Process Creation (Process)

The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.)

Command Execution (Command)

The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )

Encrypt files using gpg (FreeBSD/Linux)

linux

Encrypt files using 7z (FreeBSD/Linux)

linux

Data Encrypted with GPG4Win

windows

PureLocker Ransom Note

windows

Data Encrypt Using DiskCryptor

windows

Encrypt files using openssl utility - macOS

macos

Encrypt files using openssl (FreeBSD/Linux)

linux

Encrypt files using ccrypt (FreeBSD/Linux)

linux

Encrypt files using 7z utility - macOS

macos

Suspicious Reg Add BitLocker

windows process creation

Renamed Gpg.EXE Execution

windows process creation

Suspicious Appended Extension

windows file rename

Suspicious Creation TXT File in User Desktop

windows file event

Load Of RstrtMgr.DLL By A Suspicious Process

windows image load

Load Of RstrtMgr.DLL By An Uncommon Process

windows image load

Microsoft 365 - Potential Ransomware Activity

m365

Antivirus Ransomware Detection

antivirus

AWS EC2 Disable EBS Encryption

aws

Portable Gpg.EXE Execution

windows process creation