T1486
Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems to interrupt availability. This is the hallmark of ransomware attacks.
ATT&CK / Impact
The Colonial Pipeline attack by DarkSide ransomware encrypted critical systems, leading to fuel shortages across the US East Coast.
Defense strategies
- Offline backups
- Network segmentation
- Endpoint protection
- Incident response planning
- Early detection capabilities
Detection methods
- Monitor for mass file modifications
- Detect encryption signatures
- Track ransom note creation
- Alert on backup tampering