MITRE ATT&CK T1486 Data Encrypted for Impact: Detecting Encryption Across Endpoints, ESXi and Cloud

By the time files are being encrypted, the attacker already holds the privileges they need, so detection at this stage is about limiting the blast radius in minutes rather than preventing the intrusion. MITRE ATT&CK T1486 Data Encrypted for Impact (tactic TA0040 Impact) covers encrypting data on one host or across a network to withhold access, whether for ransom or to make it permanently unusable. ATT&CK v20 maps it to Windows, Linux, macOS, ESXi and IaaS, and links it to more than 60 malware families and 20 groups. This guide covers the v20 detection strategy and its five platform analytics, the precursors worth alerting on, the identities that make mass encryption possible and the containment steps that matter. It is for detection engineers, SOC leads and infrastructure owners. For the full ransomware programme, see the Ransomware Prevention Guide and the Ransomware Response and Recovery Guide; this page stays on the technique.

Key takeaways

• Encryption is the last step, not the first. It follows credential theft, discovery, defence tampering and recovery inhibition; the earlier stages give more time to act.
• One strategy, five platforms. ATT&CK v20 detection strategy DET0215 has analytics for Windows, Linux, macOS, ESXi and IaaS, and the signals differ sharply between them.
• Cloud encryption needs no malware. ATT&CK and the Codefinger case describe stolen AWS keys used to rewrite S3 objects with customer-provided keys (SSE-C) the victim never holds.
• Privileged identities set the scale. A domain admin, a hypervisor root account, a deployment tool or a cloud access key decides whether one host or the whole estate is encrypted.
• Only two ATT&CK mitigations apply directly. M1040 Behavior Prevention on Endpoint and M1053 Data Backup; everything else works by stopping the earlier techniques.

How the technique works

ATT&CK describes adversaries encrypting files or data on local and remote drives and withholding the decryption key, either to extract payment or, where the key is not kept, to destroy access. Ransomware typically targets Office documents, PDFs, images, media and source code, renames files or adds markers, and may first use T1222 File and Directory Permissions Modification or T1529 System Shutdown/Reboot to unlock files. Some families encrypt system files, partitions and the MBR; others encrypt virtual machines on ESXi. Worm-like spread can use T1078 Valid Accounts, T1003 OS Credential Dumping and T1021.002 SMB/Windows Admin Shares, and T1491.001 Internal Defacement (wallpapers, ESXi login messages, printed notes) often accompanies it.

For the tactic view across destruction, defacement and denial of service, see the ATT&CK Impact Tactic Guide.

Where it shows up

• Big game ransomware: ATT&CK v20 links T1486 to Akira, Medusa Group, BlackByte, INC Ransom, Scattered Spider, Storm-1811, Storm-0501 and Indrik Spider, among others, and to families including Black Basta, BlackCat, Conti, Qilin and Royal. See the Ransomware Groups Guide.
• Hypervisors: ALPHV claimed it deployed ransomware to more than 100 ESXi hypervisors in the MGM Resorts Breach 2023, after help desk social engineering and identity provider admin access. See the ESXi Ransomware Playbook.
• Cloud storage: in the Codefinger S3 Ransomware 2025 case, stolen long-term AWS keys with s3:GetObject and s3:PutObject were used to re-encrypt objects with SSE-C and schedule deletion within seven days through lifecycle rules. See the Cloud Ransomware Guide.
• Hybrid identity paths: Microsoft reported Storm-0501 stealing Entra Connect Sync credentials, taking over cloud admin roles and in some cases pushing Embargo ransomware through a Group Policy scheduled task, as covered in Storm-0501 Hybrid Cloud Attacks 2024.
• Wipers posing as ransomware: where no key is retained, the outcome is destruction; ATT&CK cites NotPetya-style behaviour under the same technique.

Detection

ATT&CK v20 maps one strategy, DET0215 Detection of Multi-Platform File Encryption for Impact, with an analytic per platform. The table pairs each with its named log sources.

Precursors to alert on

Encryption analytics fire late. These earlier signals buy time and are covered in their own technique guides:

• Recovery inhibition: shadow copy deletion, backup catalogue deletion, boot configuration changes. See the T1490 Inhibit System Recovery Defensive Guide.
• Defence tampering: EDR stopped, exclusions added, event logs cleared. See the T1685 Disable or Modify Tools Defensive Guide.
• Mass deployment: new Group Policy scheduled tasks, PsExec or WMI fan-out from one account to many hosts, deployment tool jobs outside change windows.
• Hypervisor access: SSH enabled on ESXi, new local ESXi accounts, lockdown mode turned off, vCenter role changes.
• Cloud key misuse: an access key calling S3 write APIs at volume from a new network, lifecycle configuration changes, KMS key policy edits.
• Exfiltration first: large outbound transfers to cloud storage before encryption, since most groups now steal data before encrypting it.

Detections to build first

1. File rename and write rate per process: a threshold on files modified per minute with extension change, tuned against backup and compression software.
2. Canary files: decoy files in shares and user folders that no legitimate process touches; any modification is a high-fidelity alert.
3. Ransom note pattern: the same new text or HTML file created in many directories in a short window.
4. SSE-C writes: any S3 request with SSE-C headers where the organisation does not use SSE-C.
5. VMDK renames and bulk VM power-off: on ESXi and vCenter, outside maintenance windows.

Metrics

• Time from first encryption event to host isolation: the single most important number; aim for automated isolation in minutes.
• Analytic coverage: percentage of Windows, Linux, ESXi and cloud accounts sending the log sources DET0215 needs.
• Canary coverage: percentage of file shares and datastores with decoys.
• Restore test success: percentage of critical systems restored from isolated backups within target time in the last quarter.
• Long-term cloud keys with write access: count, trending to zero.

Prevention and hardening

Where identity fits

Mass encryption is an identity outcome. The payload is generic; the reach comes from the account running it.

• Human privileged accounts: domain admins and identity provider admins let one operator push ransomware to every host. MGM shows how a help desk call became identity provider admin access and then hypervisor encryption.
• Machine identities: software deployment service accounts, Group Policy, RMM agents and backup service accounts already run code everywhere. Storm-0501 abused the Entra Connect Sync accounts; treat them as Tier 0. See the Microsoft Entra Connect and Cloud Sync Hardening Guide.
• Cloud access keys: Codefinger needed only a leaked long-term key with object read and write. Replace long-term keys with roles and short-lived credentials, and scope keys to specific buckets.
• Dormant accounts: the Colonial Pipeline Ransomware Attack 2021 began with an unused VPN account without MFA whose password had leaked.
• Recovery depends on identity too: if the directory is encrypted or untrusted, restoring hosts first is wasted effort. See Recovering IAM and PAM After Ransomware or Domain Compromise.

Containment when encryption starts

1. Isolate affected hosts and subnets immediately, at the switch level if several are hit; CISA advises powering down only if you cannot disconnect, because power-off destroys memory evidence.
2. Use out-of-band communication so the attacker does not see the response and speed up deployment.
3. Disable the identities doing the deploying: the account behind the process, deployment and sync service accounts, and any cloud keys seen writing at volume.
4. Snapshot cloud volumes and protect backups before anything else changes; cut backup systems off from production credentials.
5. Hunt for the precursor: CISA notes a ransomware event may indicate an earlier, unresolved compromise; check for new privileged accounts, RMM use and exfiltration.
6. Restore in priority order from offline backups onto clean systems, after the identity plane is trusted again.

Common failure patterns

• Online backups with domain credentials: backups reachable with the same admin accounts are encrypted or deleted with everything else.
• Hypervisors outside EDR and SIEM: ESXi often has no agent and no log forwarding, so AN0605 has no data.
• Leaked long-term cloud keys: the Codefinger pattern needs no exploit, only a key with write rights.
• Thresholds tuned out: file write rate alerts suppressed because backup or sync software triggers them, without process-level exceptions.
• Manual isolation only: waiting for an analyst at night while encryption spreads across shares.
• Restoring before resetting identity: rebuilt hosts rejoin a domain the attacker still controls.

Framework mapping

Practitioner checklist

• Confirm DET0215 log sources reach the SIEM for Windows, Linux, ESXi and cloud storage.
• Deploy file rate, canary and ransom note analytics with automated host isolation.
• Alert on the precursors: shadow copy deletion, EDR tampering, mass Group Policy tasks, ESXi SSH enabled.
• Keep SSE-C blocked on S3 buckets and replace long-term access keys with roles.
• Hold offline, immutable backups under separate identities and test restores quarterly.
• Remove standing domain and hypervisor admin rights; treat sync and deployment accounts as Tier 0.
• Enable controlled folder access or equivalent EDR behaviour blocking, in audit first.
• Rehearse containment with out-of-band communications and an identity reset sequence.

Standards and references

• MITRE ATT&CK: Data Encrypted for Impact (T1486)
• MITRE ATT&CK: Impact (TA0040)
• CISA: #StopRansomware Guide
• AWS: Using server-side encryption with customer-provided keys (SSE-C)
• Microsoft Learn: Protect important folders with controlled folder access
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Ransomware Response and Recovery Guide · ESXi Ransomware Playbook · Cloud Ransomware Guide · T1490 Inhibit System Recovery Defensive Guide · Backup Identity Isolation Guide