T1486 — Data Encrypted for Impact

# T1486 - Data Encrypted for Impact

## SOC Recommendation
Treat mass file modification/renaming with unfamiliar extensions, rapid volume shadow copy deletion, or ransom note creation as an active, time-critical incident requiring immediate isolation — this stage is usually the visible end of a much longer intrusion, so also scope backward for the initial access and lateral movement that preceded it.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Integrity Monitoring | Detect | Detect mass file rename/modification patterns and ransom note file creation across shares and endpoints. |
| File Analysis | Detect | Analyze the encrypting binary and ransom note for known ransomware family indicators. |
| File Eviction | Evict | Remove the encryptor binary and any dropped ransom-note artifacts once isolated. |
| Restore File | Restore | Restore encrypted data from an offline/immutable backup once a clean restore point predating compromise is confirmed. |

## Investigation Steps
1. Isolate affected hosts immediately in Defender for Endpoint to stop spread.
2. Review for volume shadow copy deletion (vssadmin, wmic shadowcopy delete) preceding encryption.
3. Identify patient zero and the initial access vector using the Defender for Endpoint timeline.
4. Check for EDR tampering or security tool disabling immediately before encryption began.
5. Identify what backups remain intact and offline/immutable.

## Evidence to Collect
- List of affected hosts and shares
- Ransom note content and file extension used
- Timestamp of first encryption event
- Backup deletion/tampering events
- Evidence of preceding exfiltration

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Isolate ALL affected hosts immediately | Medium | No | Yes |
| Activate BCP — notify customer operations | Low | Yes | No |
| Notify NCSC and ICO as applicable | Low | Yes | No |

## KQL
```kql
let detectionWindow = 1d;
let minEncryptedFiles = 20;
let suspiciousExtensions = dynamic([
    "lockbit", "locked", "crypt", "crypto", "enc", "encrypted", "ryuk", "conti", "hive", "clop", "blackcat", "akira"
]);
let recoveryInhibitCommands = dynamic([
    "vssadmin delete shadows",
    "vssadmin.exe delete shadows",
    "wmic shadowcopy delete",
    "wbadmin delete catalog",
    "wbadmin delete systemstatebackup",
    "get-wmiobject win32_shadowcopy",
    "get-ciminstance win32_shadowcopy",
    "bcdedit /set",
    "recoveryenabled no",
    "bootstatuspolicy ignoreallfailures",
    "schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
    "reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
    "disablesr",
    "wevtutil cl",
    "fsutil usn deletejournal",
    "cipher /w"
]);
let RansomPrepCommands =
    DeviceProcessEvents
    | where TimeGenerated >= ago(detectionWindow)
    | extend CommandLine = tolower(tostring(ProcessCommandLine))
    | where CommandLine has_any (recoveryInhibitCommands)
    | summarize
        RansomPrepCommandCount = dcount(CommandLine),
        RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),
        PrepFirstSeen = min(TimeGenerated),
        PrepLastSeen = max(TimeGenerated),
        PrepAccounts = make_set(AccountName, 10)
        by DeviceId, DeviceName;
let MassEncryptionBehavior =
    DeviceFileEvents
    | where TimeGenerated >= ago(detectionWindow)
    | where ActionType in~ ("FileCreated", "FileRenamed", "FileModified")
    | extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
    | where FileExtension in (suspiciousExtensions)
    | summarize
        EncryptedFileCount = count(),
        SampleEncryptedFiles = make_set(FileName, 20),
        AffectedPaths = make_set(FolderPath, 20),
        EncryptionFirstSeen = min(TimeGenerated),
        EncryptionLastSeen = max(TimeGenerated),
        AccountsSeen = make_set(InitiatingProcessAccountName, 10)
        by DeviceId, DeviceName
    | where EncryptedFileCount >= minEncryptedFiles;
MassEncryptionBehavior
| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName
| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,
         HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0
| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)
| where ConfidenceScore >= 2
| project
    TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),
    DeviceId,
    DeviceName,
    HasMassEncryption,
    EncryptedFileCount,
    SampleEncryptedFiles,
    AffectedPaths,
    AccountsSeen,
    HasRansomPrep,
    RansomPrepCommandCount,
    RansomPrepCommandSamples,
    PrepAccounts,
    EncryptionFirstSeen,
    EncryptionLastSeen,
    PrepFirstSeen,
    PrepLastSeen,
    ConfidenceScore
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName
| order by ConfidenceScore desc, TimeGenerated desc
```
```kql
union isfuzzy=true
    (DeviceFileEvents
    | where ActionType == "FileCreated"
    | where FileName endswith ".h0lyenc" or FolderPath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,
        DeviceName,
        Type,
        InitiatingProcessId,
        FileName,
        FolderPath,
        EventType = ActionType,
        Commandline = InitiatingProcessCommandLine,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        FileHashCustomEntity = SHA256,
        AlgorithmCustomEntity = "SHA256"
    | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
    ),
    (imFileEvent
    | where EventType == "FileCreated"
    | where TargetFilePath endswith ".h0lyenc" or TargetFilePath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        ActorUsername,
        DvcHostname,
        DvcDomain,
        DvcId,
        Type,
        EventType,
        FileHashCustomEntity = TargetFileSHA256,
        Hash,
        TargetFilePath,
        Commandline = ActingProcessCommandLine,
        AlgorithmCustomEntity = "SHA256"
    | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountDomain = tostring(split(ActorUsername, @'\')[0])
    | extend HostName = DvcHostname, HostNameDomain = DvcDomain
    | extend DeviceName = strcat(DvcHostname, ".", DvcDomain )
    )
```
```kql
let Dev0530_threats = dynamic(["Trojan:Win32/SiennaPurple.A", "Ransom:Win32/SiennaBlue.A", "Ransom:Win32/SiennaBlue.B"]);
SecurityAlert
| where ProviderName == "MDATP"
| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
| where ThreatName in~ (Dev0530_threats) or ThreatFamilyName in~ (Dev0530_threats)
| extend CompromisedEntity = tolower(CompromisedEntity)
| join kind=inner (DeviceInfo
    | extend DeviceName = tolower(DeviceName)
) on $left.CompromisedEntity == $right.DeviceName
| summarize by bin(TimeGenerated, 1d), DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId, CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities
| extend HostName = tostring(split(CompromisedEntity, ".")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)
| project-away DomainIndex
```

## Escalation Criteria
- Any confirmed encryption activity — always escalate immediately.
- Backup infrastructure itself appears targeted or deleted.
- Evidence of data exfiltration preceding encryption.
- Domain controllers or critical infrastructure affected.

## False Positive Considerations
- Legitimate full-disk encryption deployment (BitLocker rollout) misidentified as ransomware.
- Authorized backup software performing shadow copy management.
- Approved penetration test simulating ransomware behavior.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1486.json
• /api/recommendations/T1486.json
• /api/d3fend/T1486.json
• /api/mappings/T1486.json
• /api/confluence/T1486.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1486.json

Response:

{
  "technique_id": "T1486",
  "name": "Data Encrypted for Impact",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "summary": "Adversaries may encrypt data on target systems or across a network to interrupt availability — the defining behavior of ransomware — typically as the final stage of an intrusion, after credential access, discovery, and often defense evasion (backup deletion, EDR tampering) have occurred.\n",
  "soc_recommendation": "Treat mass file modification/renaming with unfamiliar extensions, rapid volume shadow copy deletion, or ransom note creation as an active, time-critical incident requiring immediate isolation — this stage is usually the visible end of a much longer intrusion, so also scope backward for the initial access and lateral movement that preceded it.\n",
  "d3fend_mappings": [
    {
      "id": "D3-FIM",
      "name": "File Integrity Monitoring",
      "relationship": "detect",
      "practical_action": "Detect mass file rename/modification patterns and ransom note file creation across shares and endpoints.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Analyze the encrypting binary and ransom note for known ransomware family indicators.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Remove the encryptor binary and any dropped ransom-note artifacts once isolated.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-RF",
      "name": "Restore File",
      "relationship": "restore",
      "practical_action": "Restore encrypted data from an offline/immutable backup once a clean restore point predating compromise is confirmed.\n",
      "tooling": [
        "Backup platform"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Isolate affected hosts immediately in Defender for Endpoint to stop spread.",
      "Review for volume shadow copy deletion (vssadmin, wmic shadowcopy delete) preceding encryption.",
      "Identify patient zero and the initial access vector using the Defender for Endpoint timeline.",
      "Check for EDR tampering or security tool disabling immediately before encryption began.",
      "Identify what backups remain intact and offline/immutable."
    ],
    "generic": [
      "Determine the scope — how many hosts and shares are affected.",
      "Identify the ransomware family/behavior pattern if possible from the ransom note or extension.",
      "Reconstruct the intrusion timeline backward from encryption to initial access.",
      "Confirm whether data was exfiltrated before encryption (double extortion).",
      "Real detection reference: \"Data Encrypted for Impact - Ransomware\" -- Detects ransomware-style mass encryption and folds in the recovery-inhibition command coverage previously duplicated in IM-004."
    ]
  },
  "evidence_to_collect": [
    "List of affected hosts and shares",
    "Ransom note content and file extension used",
    "Timestamp of first encryption event",
    "Backup deletion/tampering events",
    "Evidence of preceding exfiltration"
  ],
  "response_actions": [
    {
      "name": "Isolate ALL affected hosts immediately",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Activate BCP — notify customer operations",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    },
    {
      "name": "Notify NCSC and ICO as applicable",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-IM-002 — Data Encrypted for Impact - Ransomware",
        "description": "Detects ransomware-style mass encryption and folds in the recovery-inhibition command coverage previously duplicated in IM-004. (Source: Bell Integration baseline detection library.)",
        "query": "let detectionWindow = 1d;\nlet minEncryptedFiles = 20;\nlet suspiciousExtensions = dynamic([\n    \"lockbit\", \"locked\", \"crypt\", \"crypto\", \"enc\", \"encrypted\", \"ryuk\", \"conti\", \"hive\", \"clop\", \"blackcat\", \"akira\"\n]);\nlet recoveryInhibitCommands = dynamic([\n    \"vssadmin delete shadows\",\n    \"vssadmin.exe delete shadows\",\n    \"wmic shadowcopy delete\",\n    \"wbadmin delete catalog\",\n    \"wbadmin delete systemstatebackup\",\n    \"get-wmiobject win32_shadowcopy\",\n    \"get-ciminstance win32_shadowcopy\",\n    \"bcdedit /set\",\n    \"recoveryenabled no\",\n    \"bootstatuspolicy ignoreallfailures\",\n    \"schtasks.exe /change /tn \\\"\\\\microsoft\\\\windows\\\\systemrestore\\\\sr\\\" /disable\",\n    \"reg add \\\"hklm\\\\software\\\\policies\\\\microsoft\\\\windows nt\\\\systemrestore\\\"\",\n    \"disablesr\",\n    \"wevtutil cl\",\n    \"fsutil usn deletejournal\",\n    \"cipher /w\"\n]);\nlet RansomPrepCommands =\n    DeviceProcessEvents\n    | where TimeGenerated >= ago(detectionWindow)\n    | extend CommandLine = tolower(tostring(ProcessCommandLine))\n    | where CommandLine has_any (recoveryInhibitCommands)\n    | summarize\n        RansomPrepCommandCount = dcount(CommandLine),\n        RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),\n        PrepFirstSeen = min(TimeGenerated),\n        PrepLastSeen = max(TimeGenerated),\n        PrepAccounts = make_set(AccountName, 10)\n        by DeviceId, DeviceName;\nlet MassEncryptionBehavior =\n    DeviceFileEvents\n    | where TimeGenerated >= ago(detectionWindow)\n    | where ActionType in~ (\"FileCreated\", \"FileRenamed\", \"FileModified\")\n    | extend FileExtension = tolower(tostring(split(FileName, \".\")[-1]))\n    | where FileExtension in (suspiciousExtensions)\n    | summarize\n        EncryptedFileCount = count(),\n        SampleEncryptedFiles = make_set(FileName, 20),\n        AffectedPaths = make_set(FolderPath, 20),\n        EncryptionFirstSeen = min(TimeGenerated),\n        EncryptionLastSeen = max(TimeGenerated),\n        AccountsSeen = make_set(InitiatingProcessAccountName, 10)\n        by DeviceId, DeviceName\n    | where EncryptedFileCount >= minEncryptedFiles;\nMassEncryptionBehavior\n| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName\n| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,\n         HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0\n| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)\n| where ConfidenceScore >= 2\n| project\n    TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),\n    DeviceId,\n    DeviceName,\n    HasMassEncryption,\n    EncryptedFileCount,\n    SampleEncryptedFiles,\n    AffectedPaths,\n    AccountsSeen,\n    HasRansomPrep,\n    RansomPrepCommandCount,\n    RansomPrepCommandSamples,\n    PrepAccounts,\n    EncryptionFirstSeen,\n    EncryptionLastSeen,\n    PrepFirstSeen,\n    PrepLastSeen,\n    ConfidenceScore\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName\n| order by ConfidenceScore desc, TimeGenerated desc"
      },
      {
        "name": "d82eb796-d1eb-43c8-a813-325ce3417cef — Dev-0530 File Extension Rename",
        "description": "Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "union isfuzzy=true\n    (DeviceFileEvents\n    | where ActionType == \"FileCreated\"\n    | where FileName endswith \".h0lyenc\" or FolderPath == \"C:\\\\FOR_DECRYPT.html\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)\n        by\n        AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,\n        DeviceName,\n        Type,\n        InitiatingProcessId,\n        FileName,\n        FolderPath,\n        EventType = ActionType,\n        Commandline = InitiatingProcessCommandLine,\n        InitiatingProcessFileName,\n        InitiatingProcessSHA256,\n        FileHashCustomEntity = SHA256,\n        AlgorithmCustomEntity = \"SHA256\"\n    | extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n    | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n    ),\n    (imFileEvent\n    | where EventType == \"FileCreated\"\n    | where TargetFilePath endswith \".h0lyenc\" or TargetFilePath == \"C:\\\\FOR_DECRYPT.html\"\n    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)\n        by\n        ActorUsername,\n        DvcHostname,\n        DvcDomain,\n        DvcId,\n        Type,\n        EventType,\n        FileHashCustomEntity = TargetFileSHA256,\n        Hash,\n        TargetFilePath,\n        Commandline = ActingProcessCommandLine,\n        AlgorithmCustomEntity = \"SHA256\"\n    | extend AccountName = tostring(split(ActorUsername, @'\\')[1]), AccountDomain = tostring(split(ActorUsername, @'\\')[0])\n    | extend HostName = DvcHostname, HostNameDomain = DvcDomain\n    | extend DeviceName = strcat(DvcHostname, \".\", DvcDomain )\n    )"
      },
      {
        "name": "5f171045-88ab-4634-baae-a7b6509f483b — AV detections related to Dev-0530 actors",
        "description": "This query looks for Microsoft Defender AV detections related to Dev-0530 actors. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Dev0530_threats = dynamic([\"Trojan:Win32/SiennaPurple.A\", \"Ransom:Win32/SiennaBlue.A\", \"Ransom:Win32/SiennaBlue.B\"]);\nSecurityAlert\n| where ProviderName == \"MDATP\"\n| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatName in~ (Dev0530_threats) or ThreatFamilyName in~ (Dev0530_threats)\n| extend CompromisedEntity = tolower(CompromisedEntity)\n| join kind=inner (DeviceInfo\n    | extend DeviceName = tolower(DeviceName)\n) on $left.CompromisedEntity == $right.DeviceName\n| summarize by bin(TimeGenerated, 1d), DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId, CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n| project-away DomainIndex"
      }
    ],
    "spl": [
      {
        "name": "Mass file rename/encryption activity",
        "description": "Detect high-volume file modification events in Splunk.",
        "query": "index=endpoint earliest=-24h\n| stats count by host, file_extension\n| where count > 1000\n"
      }
    ],
    "esql": [
      {
        "name": "ab8f074c-5565-4bc4-991c-d49770e19fc9 — AWS S3 Object Encryption Using External KMS Key",
        "description": "(ESQL) Identifies use of the S3 CopyObject API where the destination object is encrypted using an AWS KMS key from an external AWS account. This behavior may indicate ransomware-style impact activity where an adversary with access to a misconfigured S3 bucket encrypts objects using a KMS key they control, preventing the bucket owner from decrypting their own data... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-aws.cloudtrail-* metadata _id, _version, _index\n\n// any successful S3 copy event\n| where\n  data_stream.dataset == \"aws.cloudtrail\"\n  and event.provider == \"s3.amazonaws.com\"\n  and event.action == \"CopyObject\"\n  and event.outcome == \"success\"\n\n// dissect request parameters to extract KMS key info and target object info\n| dissect aws.cloudtrail.request_parameters\n    \"{%{?bucketName}=%{Esql.aws_cloudtrail_request_parameters_target_bucket_name},%{?x-amz-server-side-encryption-aws-kms-key-id}=%{?arn}:%{?aws}:%{?kms}:%{?region}:%{Esql.aws_cloudtrail_request_parameters_kms_key_account_id}:%{?key}/%{Esql.aws_cloudtrail_request_parameters_kms_key_id},%{?Host}=%{?tls.client.server.name},%{?x-amz-server-side-encryption}=%{?server_side_encryption},%{?x-amz-copy-source}=%{?bucket.object.name},%{?key}=%{Esql.aws_cloudtrail_request_parameters_target_object_key}}\"\n\n// detect cross-account key usage\n| where cloud.account.id != Esql.aws_cloudtrail_request_parameters_kms_key_account_id\n\n// keep ECS and dissected fields\n| keep\n  @timestamp,\n  data_stream.namespace,\n  user.name,\n  user_agent.original,\n  source.ip,\n  aws.cloudtrail.user_identity.arn,\n  aws.cloudtrail.user_identity.type,\n  aws.cloudtrail.user_identity.access_key_id,\n  aws.cloudtrail.resources.arn,\n  aws.cloudtrail.resources.type,\n  event.action,\n  event.outcome,\n  cloud.account.id,\n  cloud.region,\n  aws.cloudtrail.request_parameters,\n  aws.cloudtrail.response_elements,\n  Esql.aws_cloudtrail_request_parameters_target_bucket_name,\n  Esql.aws_cloudtrail_request_parameters_target_object_key,\n  Esql.aws_cloudtrail_request_parameters_kms_key_account_id,\n  Esql.aws_cloudtrail_request_parameters_kms_key_id,\n  _id,\n  _version,\n  _index"
      },
      {
        "name": "1397e1b9-0c90-4d24-8d7b-80598eb9bc9a — Potential Ransomware Behavior - Note Files by System",
        "description": "(ESQL) This rule identifies the creation of multiple files with same name and over SMB by the same user. This behavior may indicate the successful remote execution of a ransomware dropping file notes to different folders. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-endpoint.events.file-* metadata _id, _version, _index\n\n// filter for file creation event done remotely over SMB with common user readable file types used to place ransomware notes\n| where event.category == \"file\" and host.os.type == \"windows\" and event.action == \"creation\" and process.pid == 4 and user.id != \"S-1-5-18\" and \n  file.extension in (\"txt\", \"htm\", \"html\", \"hta\", \"pdf\", \"jpg\", \"bmp\", \"png\") and\n  to_lower(file.path) like \"\"\"c:\\\\*\"\"\" and not to_lower(file.path) like \"\"\"c:\\\\temp\\\\*\"\"\"\n\n// truncate the timestamp to a 60-second window\n| eval Esql.time_window_date_trunc = date_trunc(60 seconds, @timestamp)\n\n| keep user.id, user.name, file.path, file.name, process.entity_id, Esql.time_window_date_trunc, host.name, host.ip, host.id\n\n// filter for same file name dropped in at least 3 unique paths by the System virtual process\n| stats Esql.file_path_count_distinct = COUNT_DISTINCT(file.path),  Esql.file_path_values = VALUES(file.path), Esql.host_ip_values = values(host.ip) by host.id, host.name, user.name, user.id, process.entity_id , file.name, Esql.time_window_date_trunc\n| where Esql.file_path_count_distinct >= 3"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Isolate an affected host immediately.",
      "Create ServiceNow SecOps task with P1 priority."
    ],
    "approval_required": [
      "Disable network shares tenant/fleet-wide.",
      "Restore from backup.",
      "Full credential rotation."
    ]
  },
  "escalation_criteria": [
    "Any confirmed encryption activity — always escalate immediately.",
    "Backup infrastructure itself appears targeted or deleted.",
    "Evidence of data exfiltration preceding encryption.",
    "Domain controllers or critical infrastructure affected."
  ],
  "false_positive_considerations": [
    "Legitimate full-disk encryption deployment (BitLocker rollout) misidentified as ransomware.",
    "Authorized backup software performing shadow copy management.",
    "Approved penetration test simulating ransomware behavior."
  ],
  "confluence": {
    "title": "T1486 - Data Encrypted for Impact Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}