Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.[1][2][3][4]
In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files.[5] In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.[6] Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.[7]
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[8][9] Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").[10][11]
In cloud environments, storage objects within compromised accounts may also be encrypted.[12] For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.[13]
Top 9%of all ATT&CK techniques for number of groups
19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 and Embargo ransomware.1
Has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”1234
62 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has the ability to encrypt files with the ChaCha20 and Curve25519 cryptographic algorithms.1Embargo also has the ability to encrypt system data and add a random six-letter extension consisting of hexadecimal characters such as ".b58eeb" or “.3d828a” to encrypted files.2
Has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”1234
Can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.12345678
Can use Elliptic Curve Encryption to encrypt files on targeted systems.1RansomHub can also skip content at regular intervals (ex. encrypt 1 MB, skip 3 MB) to optomize performance and enable faster encryption for large files.2
Data Encrypted for Impact detection strategy DET0215
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Multi-Platform File Encryption for Impact
Enterprise
5 platforms
AN0602 · Windows
High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
FileExtension
Non-standard or randomly generated file extensions may indicate encrypted content.
TargetFolder
Focus on user document folders, network shares, or system paths like %System32%.
TimeWindow
Correlate rapid writes and renames within seconds across high file count.
CommandLine
Flag common ransomware tools or functions (vssadmin delete shadows /all /quiet).
AN0603 · Linux
Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
FilenamePattern
Look for creation of ransom note files (e.g., READ_ME.txt, HELP_DECRYPT.html).
SyscallBurstRate
High write/open/unlink activity in short intervals indicates encryption attempts.
DirectoryTargeted
Correlate activity in /home, /etc, /opt, or mounted volumes.
AN0604 · macOS
Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
file encrypted|new file with .encrypted extension|disk write burst
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExtensionPattern
Encrypted files may use .locked, .enc, or ransom-specific extensions.
VolumeTargeted
Detect activity targeting mounted external or backup volumes.
AN0605 · ESXi
Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
FileType
Detect renames or write patterns involving .vmdk, .vmx, .nvram.
UserContext
Identify shell sessions opened by root or unexpected users outside maintenance window.
AN0606 · IaaS
Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware. In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets.
Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. Consider enabling versioning in cloud environments to maintain backup copies of storage objects.
$which_7z a -p#{pwd_for_encrypted_file} #{encrypted_file_path} #{input_file_path}
Cleanup Commands
$which_7z e #{encrypted_file_path}
rm #{encrypted_file_path}
Dependenciesrun with bash
Description
Finds where 7z is located
Check Prereq Commands
which_7z=`which 7z`
Get Prereq Commands
(which pkg && pkg install -y 7-zip)
GUID53e6735a-4727-44cc-b35b-237682a151ad
03
Encrypt files using ccrypt (FreeBSD/Linux)
linux
sh
—
1
Yes
Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.
Inputs
Name
Description
Type
Default Value
cped_file_path
Path where you want your copied file to be
path
/tmp/passwd
root_input_file_path
Path the target file to be encrypted. File will be copied to /tmp/ before encrypting
building the IOC (YOUR_FILES.txt) for the PureLocker ransomware
https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/
Attack Commandsrun with command_promptelevation required (root or admin)
Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.
Inputs
Name
Description
Type
Default Value
GPG_Exe_Location
Path of the GPG program
path
C:\Program Files (x86)\GnuPG\bin\gpg.exe
File_to_Encrypt_Location
Path of File
path
$env:temp\test.txt
Attack Commandsrun with powershell
Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text" # Create the test.txt file again in case prereqs failed
cmd /c "`"C:\Program Files (x86)\GnuPG\bin\gpg.exe`" --passphrase 'SomeParaphraseBlah' --batch --yes -c `"#{File_to_Encrypt_Location}`""
GPG must exist at (#{GPG_Exe_Location}). If -GetPrereqs fails, try to install GPG4WIN manually at 'https://www.gpg4win.org/download.html'. Once done, run -CheckPrereqs to confirm that it works.
Check Prereq Commands
if (test-path '#{GPG_Exe_Location}'){exit 0} else {exit 1}
Get Prereq Commands
Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text" # Create the test.txt file
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
invoke-webrequest "https://files.gpg4win.org/gpg4win-4.1.0.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\gpginstall.exe"
cmd /c "PathToAtomicsFolder\..\ExternalPayloads\gpginstall.exe" /S
GUID4541e2c2-33c8-44b1-be79-9161440f1718
09
Data Encrypt Using DiskCryptor
windows
command_prompt
Required
1
—
DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/. The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. It's important to note that a system reboot is necessary as part of the installation.
Inputs
Name
Description
Type
Default Value
dcrypt_exe
The dcrypt.exe executable from dcrypt_setup.exe
path
dcrypt.exe
Attack Commandsrun with command_promptelevation required (root or admin)
""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"
Dependenciesrun with powershell
Description
dcrypt_setup will be installed at specified location (#{dcrypt_exe})
Check Prereq Commands
if (Test-Path "${env:ProgramFiles}/dcrypt/#{dcrypt_exe}") {exit 0} else {exit 1}
Akira Ransomware drop Files with .akira Extension and Ransomnote
windows
powershell
Required
—
Yes
Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\
Attack Commandsrun with powershellelevation required (root or admin)
1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment. you have to know: " >> $env:Userprofile\Desktop\akira_readme.txt
echo "1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal" >> $env:Userprofile\Desktop\akira_readme.txt
echo "2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. [f you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them — in this case we won't be able to help. " >> $env:Userprofile\Desktop\akira_readme.txt
echo "3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we' ve managed to detect and used in order to get into. identify backup solutions and upload your data." >> $env:Userprofile\Desktop\akira_readme.txt
echo "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes — generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones." >> $env:Userprofile\Desktop\akira_readme.txt
echo "Then all of this will be published in our blog -" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
echo "2. Paste this link - https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt
Cleanup Commands
del $env:Userprofile\Desktop\akira_readme.txt
del c:\test.*.akira
The following analytic identifies the presence of files containing the keyword "Ryuk" in any folder on the C drive, indicative of Ryuk ransomware activity. (...)
The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. (...)
Detects multiple file rename or delete events occurrence within a specified period of time by a same user (these events may signalize about ransomware activity).