Ransomware and wipers have to touch a great many files in a short time, and that access pattern is visible before the damage is complete. MITRE D3FEND names this countermeasure File Access Pattern Analysis (D3-FAPA) and defines it as "Analyzing the files accessed by a process to identify unauthorized activity." It belongs to the Detect tactic as a child of Process Analysis (D3-PA), and its digital artefact is Local Resource Access, which D3FEND defines as a request of a local resource and any response from that resource. This card covers the patterns D3FEND describes, why D3FEND lists no ATT&CK mapping, how the analysis is built from operating system telemetry, how to prove it works and where it fails. It is for detection engineers, endpoint teams and ransomware readiness leads; prevention and recovery are covered in the Ransomware Prevention Guide and are not repeated here.
Key takeaways
- Process-centred, not file-centred. D3-FAPA asks what one process is doing across many files, which is different from watching a single critical file for change.
- Four patterns from D3FEND. Accessing a large number of files, accessing multiple file types, accessing files in many locations of a directory tree, and copying a file then encrypting the copy.
- Traversal is the tell. D3FEND's reference patent pairs those patterns with directory traversal, such as a process repeatedly opening and changing directories and recording files in each subdirectory.
- No ATT&CK mapping in D3FEND. D3FEND lists no related ATT&CK techniques for D3-FAPA as of version 1.6.0; the practical targets are encryption and destruction of data, labelled here as NHI Mgmt Group's view.
- Legitimate tools look the same. D3FEND's consideration is blunt: some file access may not be statistically different from authorised activity, so backup, sync, indexing and antivirus processes need careful handling.
D3-FAPA at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-FAPA (d3f:FileAccessPatternAnalysis) |
| Tactic | Detect |
| Parent technique | Process Analysis (D3-PA) |
| Digital artefact | Local Resource Access, also called Endpoint Resource Access (D3FEND relation: analyzes Local Resource Access) |
| Threats named by D3FEND | File modifying malware such as wipers and ransomware |
| D3FEND reference | CrowdStrike Inc patent US20180121650A1, "File-modifying malware detection" |
| Typical data sources | EDR file telemetry, Windows object access auditing (event 4663), Sysmon file events, Linux audit rules, file server audit logs |
| Response named in the reference | A preventative action when traversal and a malicious access pattern coincide |
| Main limitation | Authorised bulk file processes produce similar patterns |
How it works
D3FEND describes detecting file modifying malware by identifying file access patterns associated with a malicious process. The patent it cites splits the analysis into two parts, and both have to be true before action is taken.
Part one: is the process traversing a directory?
- changing the process's working directory iteratively, systematically or repeatedly;
- repeatedly performing "open directory" operations;
- walking through a directory and recording the locations of data files found in each subdirectory.
Part two: is the access pattern malicious?
| Pattern (from D3FEND) | What it looks like in telemetry | Common benign look-alikes |
|---|---|---|
| Accessing a large number of files | Hundreds of write or rename events from one process in a short window | Backup agents, sync clients, archive tools, build systems |
| Accessing multiple file types | Writes spanning documents, spreadsheets, images, databases and archives in one run | Backup and migration tools, antivirus scans (reads) |
| Accessing files in many locations of the directory | Activity spread across many user folders or share paths rather than one project folder | Search indexers, data classification scanners |
| Copying a file and encrypting the copy | Create of a new file next to the original, high-entropy content, deletion or overwrite of the original, a new extension | Legitimate encryption and compression utilities used by administrators |
The combination is what makes the detection workable. A backup agent traverses directories and reads many file types, but it normally does not rewrite the originals. A ransomware process traverses, then writes or renames across many types and locations. Adding the expected process identity (signed backup binary, known path, expected service account) removes most remaining noise.
Where identity fits
The account behind the process matters. Ransomware on file shares often runs under a compromised user or a service account with broad write access, and a backup or sync service account is exactly the identity whose normal pattern looks most like an attack. Baseline the bulk-file service accounts explicitly, alert when they run from an unexpected host or binary, and reduce their write scope. See the Service Account Behavioural Baselining Guide.
ATT&CK techniques and D3-FAPA
D3FEND lists no ATT&CK techniques for D3-FAPA, direct or inferred (D3FEND 1.6.0, checked November 2026). The Local Resource Access artefact is not linked to any ATT&CK technique in the D3FEND model. The table below is NHI Mgmt Group's view of where the patterns D3FEND describes are useful, not a D3FEND mapping. Each ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | Tactic | Pattern that applies |
|---|---|---|---|
| T1486 | Data Encrypted for Impact | Impact | Traversal with mass writes across file types, copy and encrypt, extension changes |
| T1485 | Data Destruction | Impact | Traversal with mass overwrite or deletion, the wiper case D3FEND names |
| T1083 | File and Directory Discovery | Discovery | The traversal part on its own, which often precedes encryption |
| T1005 | Data from Local System | Collection | Bulk reads across many file types and locations by an unexpected process |
| T1039 | Data from Network Shared Drive | Collection | The same bulk read pattern on file shares |
Deeper treatment is in MITRE ATT&CK T1486 Data Encrypted for Impact and MITRE ATT&CK T1485 Data Destruction.
Where it is implemented
| Implementation class | Telemetry used | Strengths | Watch out for |
|---|---|---|---|
| EDR behavioural ransomware detection | Kernel-level file events with process context | Full process, file and timing context; can stop the process | Detection logic is proprietary, so test it rather than trust it; exclusions can blind it |
| Windows object access auditing | Event 4663 "An attempt was made to access an object", generated by the Audit File System subcategory only where the object's SACL has a matching entry. Key fields: Process Name, Object Name, Accesses | Native, includes the process name; Microsoft lists WriteData, AppendData, DELETE and WRITE_DAC as high-value rights | Needs SACLs on the folders that matter; high volume on busy shares |
| Sysmon | Event 11 FileCreate, 23 FileDelete (archived), 26 FileDeleteDetected, 2 file creation time changed, 28 FileBlockShredding | Free, rich process context, filterable | No event for ordinary file reads; only raw disk reads (event 9 RawAccessRead) |
| Linux audit framework | auditctl watch rules (-w path -p wa -k key) and syscall rules on unlink, unlinkat, rename and renameat, searched with ausearch -k | Native on most distributions; per-path keys make rules easy to query | Red Hat notes performance may be affected by the amount collected; rules need persisting under /etc/audit/rules.d/ |
| File server and NAS auditing, data security analytics | Share-level access logs aggregated per user and per client | Sees encryption from a remote client that has no agent | Process identity is often missing; only the account and client address |
Collection settings for each operating system are in the Linux Logging and auditd for Defenders Guide and the Endpoint Telemetry Guide.
Implementation steps
- Pick the data that matters. Start with file servers, shared drives and the user document folders that hold business data. Record which telemetry source covers each.
- Turn on collection with process context. On Windows, enable Audit File System and add SACLs for write, delete and permission change on the chosen folders, or rely on EDR or Sysmon file events. On Linux, add audit watch rules with keys. Size log storage before enabling at scale.
- List the authorised bulk processes. Backup, sync, indexing, antivirus and migration tools, each with binary path, signer, host and service account. This is the baseline D3FEND's consideration calls for.
- Write threshold rules per process. Alert when one process outside the authorised list writes, renames or deletes more than a set number of files across more than a set number of directories or extensions in a short window. Example starting values: 100 files, 10 directories, 5 extensions in 60 seconds; these are examples to tune, not standards.
- Add the copy-and-encrypt rule. Alert on a process creating new files next to originals with a new extension and then deleting or overwriting the originals.
- Run in alert-only mode first. Tune for two to four weeks against real workloads, then enable automated host isolation or process termination only for high-confidence rules, with a documented way to release a host.
- Pair with discovery and recovery signals. Correlate with traversal events and with recovery inhibition, such as the vssadmin.exe, wbadmin.exe and bcdedit.exe misuse that CISA's ransomware guide lists for threat hunting (Inhibit System Recovery, T1490).
How to verify it works
- Benign simulation: on an isolated test host or share, run an approved script that copies a set of test files, writes encrypted copies with a new extension and deletes the originals. Confirm the alert fires, names the process and account, and arrives within the expected time.
- Authorised process check: run the real backup or sync job and confirm it does not alert; if it does, the baseline is incomplete.
- Remote client test: repeat the simulation from a second host against a file share and confirm the share-side rule fires even though the writing host has no local alert.
- Exclusion review: list every EDR and audit exclusion on file activity and confirm each has an owner and an expiry; broad folder exclusions blind this technique.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| File servers and shares with process-aware file telemetry | 100% of shares holding business data | Coverage where encryption does the most harm |
| Simulation tests detected | 100% per quarter | Proves collection and rules end to end |
| Time from first mass write to alert | Under 2 minutes | Encryption speed leaves little time to act |
| Files changed before containment in simulations | Falling over time | Shows the response, not just the alert, is fast enough |
| Benign alerts from authorised bulk processes per week | Close to zero | Shows the baseline is complete |
Limits, bypasses and failure patterns
- Slow or partial encryption: malware that encrypts slowly, only part of each file, or a few files at a time can stay under count and rate thresholds.
- Remote encryption over shares: encryption run from an unmanaged host writes to the share over the network, so endpoint rules on the file server see only the server process; share-side auditing is needed.
- Disabled or blinded sensors: attackers commonly stop security tools before encryption; pair this technique with D3-EHB Endpoint Health Beacon and the T1685 Disable or Modify Tools Defensive Guide.
- Abuse of trusted tools: legitimate archive or encryption utilities, or a compromised backup service account, produce patterns that baselines treat as authorised.
- Missing SACLs: enabling Audit File System without SACLs produces no 4663 events, and nobody notices until an incident.
- Read-only blind spot: Sysmon has no event for ordinary file reads, so bulk read collection before exfiltration needs EDR or object access auditing.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring | Monitoring for unauthorised local activity |
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection | Behavioural detection of ransomware and wipers |
| NIST SP 800-53 Rev 5 | AU-6 Audit Record Review, Analysis, and Reporting | Analysing file access audit records |
| NIST CSF 2.0 | DE.CM-09, DE.AE-02, PR.DS-01 | Monitoring software and data; analysing adverse events; protecting data at rest |
| MITRE D3FEND | D3-PA, D3-FAPA | Parent and technique |
Related countermeasures
- File Integrity Monitoring (D3-FIM) and File Creation Analysis (D3-FCA): file-centred views that complement this process-centred one; see D3-FIM File Integrity Monitoring and D3-FCA File Creation Analysis.
- Database Query String Analysis: the Process Analysis sibling for databases; see D3-DQSA Database Query String Analysis.
- Resource Access Pattern Analysis: the identity-centred view of what resources an account reaches; see D3-RAPA Resource Access Pattern Analysis.
- The wider model: see the MITRE D3FEND Guide.
Practitioner checklist
- Map which telemetry source covers each file server, share and user data folder.
- Add SACLs for write, delete and permission change where Windows auditing is the source.
- Keep a register of authorised bulk file processes with binary, signer, host and account.
- Alert on mass write, rename or delete across directories and file types by unlisted processes.
- Alert on copy-then-encrypt behaviour and mass extension changes.
- Monitor shares server-side for encryption from unmanaged clients.
- Correlate with recovery inhibition commands and sensor health loss.
- Run a benign encryption simulation each quarter and record detection time.
- Review file activity exclusions for owner and expiry.
Standards and references
- MITRE D3FEND: File Access Pattern Analysis (D3-FAPA)
- Google Patents: US20180121650A1 File-modifying malware detection
- MITRE ATT&CK: T1486 Data Encrypted for Impact
- CISA: #StopRansomware Guide
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- Microsoft Learn: Event 4663, an attempt was made to access an object
- Microsoft Learn: Sysmon
- Red Hat: Auditing the system (RHEL 9 Security hardening)
Related NHI Mgmt Group resources: Ransomware Prevention Guide · MITRE ATT&CK T1486 Data Encrypted for Impact · Linux Logging and auditd for Defenders Guide · EDR Guide · MITRE D3FEND Guide