# T1486 - Data Encrypted for Impact

## SOC Recommendation
Treat mass file modification/renaming with unfamiliar extensions, rapid volume shadow copy deletion, or ransom note creation as an active, time-critical incident requiring immediate isolation — this stage is usually the visible end of a much longer intrusion, so also scope backward for the initial access and lateral movement that preceded it.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Integrity Monitoring | Detect | Detect mass file rename/modification patterns and ransom note file creation across shares and endpoints. |
| File Analysis | Detect | Analyze the encrypting binary and ransom note for known ransomware family indicators. |
| File Eviction | Evict | Remove the encryptor binary and any dropped ransom-note artifacts once isolated. |
| Restore File | Restore | Restore encrypted data from an offline/immutable backup once a clean restore point predating compromise is confirmed. |

## Investigation Steps
1. Isolate affected hosts immediately in Defender for Endpoint to stop spread.
2. Review for volume shadow copy deletion (vssadmin, wmic shadowcopy delete) preceding encryption.
3. Identify patient zero and the initial access vector using the Defender for Endpoint timeline.
4. Check for EDR tampering or security tool disabling immediately before encryption began.
5. Identify what backups remain intact and offline/immutable.

## Evidence to Collect
- List of affected hosts and shares
- Ransom note content and file extension used
- Timestamp of first encryption event
- Backup deletion/tampering events
- Evidence of preceding exfiltration

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Isolate ALL affected hosts immediately | Medium | No | Yes |
| Activate BCP — notify customer operations | Low | Yes | No |
| Notify NCSC and ICO as applicable | Low | Yes | No |

## KQL
```kql
let detectionWindow = 1d;
let minEncryptedFiles = 20;
let suspiciousExtensions = dynamic([
    "lockbit", "locked", "crypt", "crypto", "enc", "encrypted", "ryuk", "conti", "hive", "clop", "blackcat", "akira"
]);
let recoveryInhibitCommands = dynamic([
    "vssadmin delete shadows",
    "vssadmin.exe delete shadows",
    "wmic shadowcopy delete",
    "wbadmin delete catalog",
    "wbadmin delete systemstatebackup",
    "get-wmiobject win32_shadowcopy",
    "get-ciminstance win32_shadowcopy",
    "bcdedit /set",
    "recoveryenabled no",
    "bootstatuspolicy ignoreallfailures",
    "schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
    "reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
    "disablesr",
    "wevtutil cl",
    "fsutil usn deletejournal",
    "cipher /w"
]);
let RansomPrepCommands =
    DeviceProcessEvents
    | where TimeGenerated >= ago(detectionWindow)
    | extend CommandLine = tolower(tostring(ProcessCommandLine))
    | where CommandLine has_any (recoveryInhibitCommands)
    | summarize
        RansomPrepCommandCount = dcount(CommandLine),
        RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),
        PrepFirstSeen = min(TimeGenerated),
        PrepLastSeen = max(TimeGenerated),
        PrepAccounts = make_set(AccountName, 10)
        by DeviceId, DeviceName;
let MassEncryptionBehavior =
    DeviceFileEvents
    | where TimeGenerated >= ago(detectionWindow)
    | where ActionType in~ ("FileCreated", "FileRenamed", "FileModified")
    | extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
    | where FileExtension in (suspiciousExtensions)
    | summarize
        EncryptedFileCount = count(),
        SampleEncryptedFiles = make_set(FileName, 20),
        AffectedPaths = make_set(FolderPath, 20),
        EncryptionFirstSeen = min(TimeGenerated),
        EncryptionLastSeen = max(TimeGenerated),
        AccountsSeen = make_set(InitiatingProcessAccountName, 10)
        by DeviceId, DeviceName
    | where EncryptedFileCount >= minEncryptedFiles;
MassEncryptionBehavior
| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName
| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,
         HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0
| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)
| where ConfidenceScore >= 2
| project
    TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),
    DeviceId,
    DeviceName,
    HasMassEncryption,
    EncryptedFileCount,
    SampleEncryptedFiles,
    AffectedPaths,
    AccountsSeen,
    HasRansomPrep,
    RansomPrepCommandCount,
    RansomPrepCommandSamples,
    PrepAccounts,
    EncryptionFirstSeen,
    EncryptionLastSeen,
    PrepFirstSeen,
    PrepLastSeen,
    ConfidenceScore
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName
| order by ConfidenceScore desc, TimeGenerated desc
```
```kql
union isfuzzy=true
    (DeviceFileEvents
    | where ActionType == "FileCreated"
    | where FileName endswith ".h0lyenc" or FolderPath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,
        DeviceName,
        Type,
        InitiatingProcessId,
        FileName,
        FolderPath,
        EventType = ActionType,
        Commandline = InitiatingProcessCommandLine,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        FileHashCustomEntity = SHA256,
        AlgorithmCustomEntity = "SHA256"
    | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
    ),
    (imFileEvent
    | where EventType == "FileCreated"
    | where TargetFilePath endswith ".h0lyenc" or TargetFilePath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        ActorUsername,
        DvcHostname,
        DvcDomain,
        DvcId,
        Type,
        EventType,
        FileHashCustomEntity = TargetFileSHA256,
        Hash,
        TargetFilePath,
        Commandline = ActingProcessCommandLine,
        AlgorithmCustomEntity = "SHA256"
    | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountDomain = tostring(split(ActorUsername, @'\')[0])
    | extend HostName = DvcHostname, HostNameDomain = DvcDomain
    | extend DeviceName = strcat(DvcHostname, ".", DvcDomain )
    )
```
```kql
let Dev0530_threats = dynamic(["Trojan:Win32/SiennaPurple.A", "Ransom:Win32/SiennaBlue.A", "Ransom:Win32/SiennaBlue.B"]);
SecurityAlert
| where ProviderName == "MDATP"
| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
| where ThreatName in~ (Dev0530_threats) or ThreatFamilyName in~ (Dev0530_threats)
| extend CompromisedEntity = tolower(CompromisedEntity)
| join kind=inner (DeviceInfo
    | extend DeviceName = tolower(DeviceName)
) on $left.CompromisedEntity == $right.DeviceName
| summarize by bin(TimeGenerated, 1d), DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId, CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities
| extend HostName = tostring(split(CompromisedEntity, ".")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)
| project-away DomainIndex
```

## Escalation Criteria
- Any confirmed encryption activity — always escalate immediately.
- Backup infrastructure itself appears targeted or deleted.
- Evidence of data exfiltration preceding encryption.
- Domain controllers or critical infrastructure affected.

## False Positive Considerations
- Legitimate full-disk encryption deployment (BitLocker rollout) misidentified as ransomware.
- Authorized backup software performing shadow copy management.
- Approved penetration test simulating ransomware behavior.

Generated by SOC Response Atlas by Basyrix.