{
  "technique_id": "T1486",
  "name": "Data Encrypted for Impact",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "summary": "Adversaries may encrypt data on target systems or across a network to interrupt availability — the defining behavior of ransomware — typically as the final stage of an intrusion, after credential access, discovery, and often defense evasion (backup deletion, EDR tampering) have occurred.\n",
  "generated_by": "SOC Response Atlas by Basyrix"
}