tfMITRE ATT&CK technique

Data Encrypted for Impact T1486

Tactic: Impact
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.5
Created: 15 March 2019
Last modified: 12 May 2026
Contributors: Oleg Kolesnikov, Securonix; Mayuresh Dani, Qualys; Harshal Tupsamudre, Qualys; Travis Smith, Qualys; ExtraHop

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.[1][2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 10%

Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 6%

Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 10%

Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.

Data Encrypted for Impact MITRE reference T1486

Top 9%of all ATT&CK techniques for number of groups

19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has deployed ransomware and has announced partnerships with ransomware groups including Vect and CipherForce in online criminal forums.1

created 2026-07-161 referenceaka PCPCat

VOID MANTICOREG1055 ↗

Has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.1 2

created 2026-04-202 referencesaka COBALT MYSTIQUE

Storm-0501G1053 ↗

Has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 and Embargo ransomware.1

created 2025-10-191 reference

Medusa GroupG1051 ↗

Has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”1 2 3 4

created 2025-10-154 references

Water GaluraG1050 ↗

Has encrypted files on victim networks through the generation of Qilin ransomware payloads.1

created 2025-09-291 referenceaka GOLD FEATHER

Storm-1811G1046 ↗

Is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.1

created 2025-03-141 reference

All 19 groups for this technique · 6 newest in this preview

Offense vs defense T1486

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 4Sigma rules (cumulative) · 17Splunk ESCU (cumulative) · 10

first rule: 2019 Q1 · 4 of 4 campaigns plotted

Data Encrypted for Impact detection strategy DET0215

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Multi-Platform File Encryption for Impact

Enterprise

5 platforms

AN0602 · Windows

High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileExtension	Non-standard or randomly generated file extensions may indicate encrypted content.
TargetFolder	Focus on user document folders, network shares, or system paths like %System32%.
TimeWindow	Correlate rapid writes and renames within seconds across high file count.
CommandLine	Flag common ransomware tools or functions (vssadmin delete shadows /all /quiet).

AN0603 · Linux

Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File ModificationDC0061	auditd:SYSCALL	openat, write, rename, unlink

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilenamePattern	Look for creation of ransom note files (e.g., READ_ME.txt, HELP_DECRYPT.html).
SyscallBurstRate	High write/open/unlink activity in short intervals indicates encryption attempts.
DirectoryTargeted	Correlate activity in /home, /etc, /opt, or mounted volumes.

AN0604 · macOS

Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec srm\|exec openssl\|exec gpg
File ModificationDC0061	macos:unifiedlog	file encrypted\|new file with .encrypted extension\|disk write burst

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExtensionPattern	Encrypted files may use .locked, .enc, or ransom-specific extensions.
VolumeTargeted	Detect activity targeting mounted external or backup volumes.

AN0605 · ESXi

Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	esxi:vmkernel	rename .vmdk to .*.locked\|datastore write spike
Command ExecutionDC0064	esxi:shell	openssl\|tar\|dd

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileType	Detect renames or write patterns involving .vmdk, .vmx, .nvram.
UserContext	Identify shell sessions opened by root or unexpected users outside maintenance window.

AN0606 · IaaS

Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage ModificationDC0023	AWS:CloudTrail	PutObject (with SSE-C), UploadPart (SSE-C)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SSEHeader	SSE-C headers indicate attacker-controlled encryption keys.
AffectedBucket	Prioritize logs, backups, or shared document storage buckets.
UserAgent	Detect scripted automation vs console-based API behavior.

Tests10Executorssh 6 · cmd 2 · PowerShell 2Need elevation3 of 10Have prerequisites7Have cleanup9Platformslinux, windows, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Encrypt files using gpg (FreeBSD/Linux)

linux

—

Yes

Uses gpg to encrypt a file

Input arguments

Name	Type	Default	Description
encryption_alg	string	AES-256	encryption algorithm of the file
input_file_path	path	/etc/passwd	path to the file that you want to encrypt
encrypted_file_path	path	/tmp/passwd.gpg	path to the encrypted file
pwd_for_encrypted_file	string	passwd	the password that you want for the encrypted file

Attack command

echo "#{pwd_for_encrypted_file}" | $which_gpg --batch --yes --passphrase-fd 0 --cipher-algo #{encryption_alg} -o #{encrypted_file_path} -c #{input_file_path}

Cleanup command

rm #{encrypted_file_path}

Prerequisite

Finds where gpg is located

Check

which_gpg=`which gpg`

Satisfy

(which pkg && pkg install -y gnupg)||(which yum && yum -y install epel-release gpg)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y gpg)

GUID827122ce-6158-4726-96c5-7bfc9c10ee8e

Encrypt files using 7z (FreeBSD/Linux)

linux

—

Yes

Uses 7z to encrypt a file

Input arguments

Name	Type	Default	Description
input_file_path	path	/etc/passwd	path to the file that you want to encrypt
encrypted_file_path	path	/tmp/passwd.zip	path to the encrypted file
pwd_for_encrypted_file	string	passwd	the password that you want for the encrypted file

Attack command

$which_7z a -p#{pwd_for_encrypted_file} #{encrypted_file_path} #{input_file_path}

Cleanup command

$which_7z e #{encrypted_file_path}
rm #{encrypted_file_path}

Prerequisite

Finds where 7z is located

Check

which_7z=`which 7z`

Satisfy

(which pkg && pkg install -y 7-zip)

GUID56942781-6bd4-486d-ae42-94192e1600d7

Encrypt files using ccrypt (FreeBSD/Linux)

linux

—

Yes

Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.

Input arguments

Name	Type	Default	Description
cped_file_path	path	/tmp/passwd	Path where you want your copied file to be
root_input_file_path	path	/etc/passwd	Path the target file to be encrypted. File will be copied to /tmp/ before encrypting
pwd_for_encrypted_file	string	passwd	Password to use for encryption

Attack command

which_ccencrypt=`which ccencrypt`
cp #{root_input_file_path} #{cped_file_path};
$which_ccencrypt -T -K #{pwd_for_encrypted_file} #{cped_file_path}

Cleanup command

rm #{cped_file_path}.cpt

Prerequisite

Finds where ccencrypt and ccdecrypt are located

Check

which_ccencrypt=`which ccencrypt`
which_ccdecrypt=`which ccdecrypt`

Satisfy

(which pkg && pkg install -y ccript)||(which yum && yum -y install epel-release ccrypt)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y ccrypt)

GUID227893ed-62bd-46fa-a39a-cf3a3b602b90

Encrypt files using openssl (FreeBSD/Linux)

linux

—

Yes

Uses openssl to encrypt a file

Input arguments

Name	Type	Default	Description
input_file_path	path	/etc/passwd	path to the file that you want to encrypt
public_key_path	path	/tmp/pub.pem	path to the public key
private_key_path	path	/tmp/key.pem	path to the private key
encrypted_file_path	path	/tmp/passwd.zip	path to the encrypted file
encryption_bit_size	integer	2048	size of the bit of encryption

Attack command

which_openssl=`which openssl`
$which_openssl genrsa -out #{private_key_path} #{encryption_bit_size}
$which_openssl rsa -in #{private_key_path} -pubout -out #{public_key_path}
$which_openssl rsautl -encrypt -inkey #{public_key_path} -pubin -in #{input_file_path} -out #{encrypted_file_path}

Cleanup command

$which_openssl rsautl -decrypt -inkey #{private_key_path} -in #{encrypted_file_path}
rm #{encrypted_file_path}

Prerequisite

Finds where openssl is located

Check

which_openssl=`which openssl`

GUID786362b8-0659-488f-866f-5b18d6769d99

PureLocker Ransom Note

windows

cmd

Required

—

Yes

Encrypt files using 7z utility - macOS

macos

—

Yes

This test encrypts the file(s) using the 7z utility

Input arguments

Name	Type	Default	Description
file_password	string	ARTPass	Password to be provided for archiving the file
input_file_path	path	~/test.txt	Path to the file that you want to encrypt
encrypted_file_name	string	ARTArchive.7z	Name of the archive to be created

Attack command

7z a -p #{file_password} -mhe=on #{encrypted_file_name} #{input_file_path}

Cleanup command

rm #{encrypted_file_name}

Prerequisite

Check if 7z command exists on the machine

Check

which 7z

Satisfy

echo Installing 7z, using brew
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install p7zip

GUID6416f14e-2956-43d2-b401-ec7f8121bd07

Encrypt files using openssl utility - macOS

macos

—

Yes

This test encrypts the file(s) using the openssl utility

Input arguments

Name	Type	Default	Description
input_file_path	path	~/test.txt	Path to the file that you want to encrypt
output_file_name	string	ARTFile	Path to the file that you want to encrypt
encryption_option	string	-pbkdf2	Specifiy the required encryption option

Attack command

openssl enc #{encryption_option} -in #{input_file_path} -out #{output_file_name}

Cleanup command

rm #{output_file_name}

GUIDf556eae9-8c59-4625-b863-c5d3ee5c0ec2

Data Encrypted with GPG4Win

windows

PowerShell

—

Yes

Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.

Input arguments

Name	Type	Default	Description
GPG_Exe_Location	path	C:\Program Files (x86)\GnuPG\bin\gpg.exe	Path of the GPG program
File_to_Encrypt_Location	path	$env:temp\test.txt	Path of File

Attack command

Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text"  # Create the test.txt file again in case prereqs failed
cmd /c "`"C:\Program Files (x86)\GnuPG\bin\gpg.exe`" --passphrase 'SomeParaphraseBlah' --batch --yes -c `"#{File_to_Encrypt_Location}`""

Cleanup command

Remove-Item -Path "#{File_to_Encrypt_Location}" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "#{File_to_Encrypt_Location}.gpg" -Force -ErrorAction SilentlyContinue

Prerequisite

GPG must exist at (#{GPG_Exe_Location}). If -GetPrereqs fails, try to install GPG4WIN manually at 'https://www.gpg4win.org/download.html'. Once done, run -CheckPrereqs to confirm that it works.

Check

if (test-path '#{GPG_Exe_Location}'){exit 0} else {exit 1}

Satisfy

Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text"  # Create the test.txt file
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
invoke-webrequest "https://files.gpg4win.org/gpg4win-4.1.0.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\gpginstall.exe"
cmd /c "PathToAtomicsFolder\..\ExternalPayloads\gpginstall.exe" /S

GUID9e13ff96-427f-4d4e-8645-38047fe8f865

Data Encrypt Using DiskCryptor

windows

cmd

Required

—

DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/. The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. It's important to note that a system reboot is necessary as part of the installation.

Input arguments

Name	Type	Default	Description
dcrypt_exe	path	dcrypt.exe	The dcrypt.exe executable from dcrypt_setup.exe

Attack command

""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"

Prerequisite

dcrypt_setup will be installed at specified location (#{dcrypt_exe})

Check

if (Test-Path "${env:ProgramFiles}/dcrypt/#{dcrypt_exe}") {exit 0} else {exit 1}

Satisfy

Write-Host Downloading DiskCryptor installer
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/DavidXanatos/DiskCryptor/releases/download/1.1.846.118/dcrypt_setup_1.1.846.118.exe" -OutFile      "PathToAtomicsFolder\..\ExternalPayloads\dcrypt_setup_1.1.846.118.exe"
Write-Host Install DiskCryptor
Start-Process "PathToAtomicsFolder\..\ExternalPayloads\dcrypt_setup_1.1.846.118.exe" -Wait -ArgumentList "/s"

GUIDd54517cf-7be2-4b6b-9e78-9dd6a3ee780f

Akira Ransomware drop Files with .akira Extension and Ransomnote

windows

PowerShell

Required

—

Yes

Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\

Attack command

1..100 | ForEach-Object { $out = new-object byte[] 1073741; (new-object Random).NextBytes($out); [IO.File]::WriteAllBytes("c:\test.$_.akira", $out) }
echo "Hi friends" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "Whatever who you are and what your title is if you' re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption  Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment. you have to know: " >> $env:Userprofile\Desktop\akira_readme.txt
echo "1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal" >> $env:Userprofile\Desktop\akira_readme.txt
echo "2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. [f you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them — in this case we won't be able to help.  " >> $env:Userprofile\Desktop\akira_readme.txt
echo "3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we' ve managed to detect and used in order to get into. identify backup solutions and upload your data." >> $env:Userprofile\Desktop\akira_readme.txt
echo "4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes — generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones." >> $env:Userprofile\Desktop\akira_readme.txt
echo "Then all of this will be published in our blog -" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
echo "2. Paste this link - https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
echo "" >> $env:Userprofile\Desktop\akira_readme.txt
echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt

Cleanup command

del $env:Userprofile\Desktop\akira_readme.txt 
del c:\test.*.akira

GUIDbb935f6e-1042-4d49-9945-8124c67ffe59

Tests from Atomic Red Team (MIT licence) · technique definition

Data Encrypted for Impact detections T1486

27 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 10%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs