T1486 — Data Encrypted for Impact

Tactic: Impact · Platforms: ESXi, IaaS, Linux, macOS, Windows

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption…

Sigma detection rules (5)

title: T1486 Data Encrypted for Impact
id: afc0fbd5-70d7-4ea7-a77a-00de20d67a54
description: 'Detects file-creation events matching common ransomware-appended extensions (.locked, .encrypted, .crypt, .enc, .lockbit, .conti) or ransom-note filenames (README, DECRYPT, HOW_TO_DECRYPT), consistent with mass file encryption for impact. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: FileExtension, TargetFolder, TimeWindow, MassRenameThreshold.'
references:
  - https://attack.mitre.org/techniques/T1486
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.impact
  - attack.t1486

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_ext:
    EventID: '11'
    TargetFilename|endswith:
      - '.locked'
      - '.encrypted'
      - '.crypt'
      - '.enc'
      - '.lockbit'
      - '.conti'
      - '.ryuk'
  selection_ransom_note:
    EventID: '11'
    TargetFilename|contains:
      - 'README'
      - 'DECRYPT'
      - 'HOW_TO_DECRYPT'
      - 'HOW_TO_RESTORE'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_ext or selection_ransom_note) and not filter_system_account

falsepositives:
  - Legitimate encryption/backup software or archival tools that use similar extensions; System and service accounts are excluded via filter_system_account; tune further with MassRenameThreshold correlation and process/path allowlists if noise remains.

level: critical

title: T1486 Data Encrypted for Impact
id: 7e358fcf-7b51-40dd-b53e-442b87cf176b
description: 'Detection of Multi-Platform File Encryption for Impact. Requires both an openssl/gpg encryption invocation AND a targeted directory argument together (previously either condition alone could fire, causing mass false positives from directory-only matches with no encryption command present). Also fixed the openssl argv match, which previously required enc and -aes to co-occur in a single argv token and could never fire. Tune using: FilenamePattern, SyscallBurstRate, DirectoryTargeted.'
references:
  - https://attack.mitre.org/techniques/T1486
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.impact
  - attack.t1486

logsource:
  category: process_creation
  product: linux

detection:
  selection_openssl:
    type: EXECVE
    a0|endswith: '/openssl'
    a1: 'enc'
    a2|contains: 'aes'
  selection_gpg:
    type: EXECVE
    a0|endswith: '/gpg'
    a1|contains:
      - '-c'
      - '--symmetric'
      - '--cipher-algo'
  selection_dir:
    - a2|contains:
        - '/home/'
        - '/var/www/'
        - '/mnt/'
    - a3|contains:
        - '/home/'
        - '/var/www/'
        - '/mnt/'
    - a4|contains:
        - '/home/'
        - '/var/www/'
        - '/mnt/'

  condition: (selection_openssl or selection_gpg) and selection_dir

falsepositives:
  - Legitimate encryption of files or backups for transport or compliance that targets these same directories; scope DirectoryTargeted to exclude approved backup-encryption workflows and correlate with SyscallBurstRate for mass-encryption behavior.

level: critical

title: T1486 Data Encrypted for Impact
id: adbdbc5b-8734-4693-aa9a-8f4a38aa2c6c
description: 'Detection of Multi-Platform File Encryption for Impact. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExtensionPattern, VolumeTargeted.'
references:
  - https://attack.mitre.org/techniques/T1486
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.impact
  - attack.t1486

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.enc'
  selection_volume:
    TargetFilename|contains:
      - '/Users/'
      - '/Volumes/'
  condition: selection and selection_volume

falsepositives:
  - Legitimate disk encryption utilities and backup software occasionally rename files with similar extensions during archival, so a burst of renames across many user directories in a short window is the meaningful ransomware indicator rather than any single event.

level: critical

title: T1486 Data Encrypted for Impact
id: 85c5aa03-e7d4-4d92-8da6-eada1085de87
description: 'Detection of Multi-Platform File Encryption for Impact. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SSEHeader, AffectedBucket, UserAgent.'
references:
  - https://attack.mitre.org/techniques/T1486
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.impact
  - attack.t1486

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_ssec:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutObject'
    requestParameters.x-amz-server-side-encryption-customer-algorithm: 'AES256'
  selection_kms_disable:
    eventSource: 'kms.amazonaws.com'
    eventName:
      - 'DisableKey'
      - 'ScheduleKeyDeletion'

  condition: 1 of selection_*

falsepositives:
  - Applications legitimately using customer-provided SSE-C keys for their own encryption workflow will match the first selection, so verify the key material and caller identity against known application service roles.

level: critical

title: T1486 Data Encrypted for Impact
id: 4843ef5e-0e07-428c-bd24-1f5136994fed
description: 'Detection of Multi-Platform File Encryption for Impact. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileType, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1486
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.impact
  - attack.t1486

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'openssl enc'
      - 'openssl aes'
  selection_target:
    CommandLine|contains:
      - '.vmdk'
      - '.vmx'
      - '/vmfs/volumes/'

  condition: selection_tool and selection_target

falsepositives:
  - Legitimate use of openssl for certificate or backup archive handling on datastore files; many ESXi ransomware strains (ESXiArgs, Cheerscrypt, Royal) ship a custom static binary rather than openssl, so this rule will miss those and should be paired with mass file-extension-rename monitoring for FileType.

level: critical

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1486 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan