title: Data Encrypted for Impact (T1486)
id: df00tech-t1486
status: experimental
description: "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted. In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted and often renamed or tagged with specific file markers. Adversaries may also encrypt critical system files, disk partitions, MBR, virtual machines hosted on ESXi, or cloud storage objects."
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://df00tech.com/detections/T1486
author: df00tech
date: 2026/04/13
tags:
  - attack.t1486
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: process_creation
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "Legitimate encryption tools (BitLocker, VeraCrypt, 7-Zip) encrypting large numbers of files during backup operations"
  - File migration or archival tools that rename files with new extensions during processing
  - Anti-ransomware tools that create decoy/canary files with ransomware-like extensions for honeypot detection
  - Disaster recovery testing that involves intentional shadow copy deletion as part of DR exercises
level: critical