Ransomware gets the headlines, but the technique underneath has a plain name. T1486, Data Encrypted for Impact, is the encryption step itself. MITRE files it under impact, and it applies to ESXi, IaaS, Linux, macOS and Windows.
How attackers use it
Adversaries encrypt data on target systems, or on many systems across a network, to interrupt availability. They withhold the decryption key. The aim may be payment in exchange for the key, which is ransomware, or permanent loss of access where the key is never saved or sent.
In the ransomware case, MITRE notes that common user files are typically encrypted: Office documents, PDFs, images, video, audio, text and source code. Files are often renamed or tagged with markers. Adversaries may first need other behaviors to unlock the files, such as file and directory permission modification or system shutdown and reboot. Sometimes they go further and encrypt critical system files, disk partitions and the master boot record. They may also encrypt virtual machines on ESXi or other hypervisors.
To maximize impact, the encrypting malware may spread by itself using valid accounts, OS credential dumping and SMB with Windows admin shares. It may also combine with internal defacement, such as changing wallpapers or ESXi login messages, to deliver a ransom message.
The technique reaches into the cloud too. One of MITRE's detection analytics covers encryption of cloud storage objects with server side encryption using customer provided keys (SSE-C), or replacing objects with encrypted versions through PutObject calls.
MITRE lists a long set of groups and ransomware families that use the technique, including well known names. The pattern is the same across them.
How to detect it
MITRE's detection strategy has one analytic per environment.
- Windows: many file writes with unusual extensions, followed by ransom note creation, registry changes or shadow copy deletion. Command line tools such as vssadmin, wbadmin, cipher or PowerShell often appear.
- Linux: recursive encryption of user or system directories with custom or open source tools, including overwriting existing data and dropping ransom notes.
- macOS: ransomware encrypting user folders such as Documents and Desktop, with ransom notes appearing in many directories.
- ESXi: encryption of VMware files in datastores, such as virtual disks, VM configuration and logs, frequently renamed to a marker extension. Often tied to shell commands run through the console, SSH or vSphere.
- Cloud: SSE-C encryption of storage objects, or replacement of objects with encrypted copies.
MITRE does not list log sources or event IDs for this technique. These signals are practical to collect:
- File activity rate per process, with an alert on thousands of writes or renames in a short window.
- Creation of the same new file name in many directories, which is how ransom notes behave.
- Deletion of recovery data, covered in the separate technique T1490.
- Stopping of database, backup and security services, covered in T1489.
- Cloud storage logs with PutObject calls that use customer provided encryption headers.
The best detection happens before encryption starts. The same chain MITRE lists, credential theft, admin share use and recovery deletion, tends to show up first.
Click through it at your own pace, or open it full screen.
How to reduce the risk
MITRE lists two mitigations.
- Behavior prevention on endpoint. On Windows 10, enable cloud delivered protection and Attack Surface Reduction rules to block execution of files that resemble ransomware. In AWS, create an IAM policy to restrict or block the use of SSE-C on S3 buckets.
- Data backup. Maintain disaster recovery plans and regularly take and test backups. Keep backups off system and protected from the methods adversaries use to destroy them. Consider enabling versioning in cloud environments.
Add isolation: if encryption begins, you want a way to cut a host off the network fast, and a plan for who decides.
Check your own environment
- Pick a critical system and do a restore test this quarter. Record how long it took.
- Confirm that backup storage cannot be reached with ordinary domain admin credentials.
- Check whether ASR rules are enabled on Windows endpoints, in audit mode first if you need to measure impact.
- Review S3 bucket policies for SSE-C and block it where you do not use it.
- Confirm versioning is on for storage that holds important data.
- Confirm ESXi shell and SSH access are limited and logged.
Quick check
What is the difference between the ransom and the destructive case?
In ransomware, the key is withheld for payment. In the destructive case the key is never saved or transmitted, so data is permanently inaccessible.
Which cloud encryption feature does MITRE suggest restricting in AWS?
SSE-C, server side encryption with customer provided keys, through an IAM policy.
Why test restores and not only take backups?
A backup that has never been restored may not work when needed, and MITRE's mitigation says to regularly take and test backups.
