{
  "technique_id": "T1486",
  "d3fend_mappings": [
    {
      "id": "D3-FIM",
      "name": "File Integrity Monitoring",
      "relationship": "detect",
      "practical_action": "Detect mass file rename/modification patterns and ransom note file creation across shares and endpoints.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Analyze the encrypting binary and ransom note for known ransomware family indicators.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Remove the encryptor binary and any dropped ransom-note artifacts once isolated.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-RF",
      "name": "Restore File",
      "relationship": "restore",
      "practical_action": "Restore encrypted data from an offline/immutable backup once a clean restore point predating compromise is confirmed.\n",
      "tooling": [
        "Backup platform"
      ]
    }
  ]
}