T1486
Data Encrypted for Impact
ESXi · IaaS · Linux · macOS · Windows6 pieces on this siteT1486 on attack.mitre.org
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware response plan: from the first renamed file to the review
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
First 15 minutes: a ransom note, or files that suddenly will not open
Encryption is under way or has just finished. Contain without destroying the memory that holds the operator's tools, protect the backups, and start the clocks that legal and your insurer will ask about.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Somebody disabled the antivirus on eleven servers
You have minutes rather than hours. Say what you do first, and what you deliberately do not do.
Read
Analyses, case studies, guides, references and interview questions.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
how MITRE says to see it
Detection of Multi-Platform File Encryption for Impact
- High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.
- Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.
- Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using `srm`, `gpg`, or compiled payloads. Often correlated with ransom note creation in multiple directories.
- Ransomware encrypts.vmdk,.vmx,.log, or VM config files in VMFS datastores. May rename to.locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through `dcui`, SSH, or vSphere.
what reduces it
- M1053 Data Backup. Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. Consider enabling versioning in cloud environments to maintain backup copies of storage objects.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware. In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets.