T1486 Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. MITRE ATT&CK

7 Sigma rules T1486 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

criticalLockerGoga Ransomware ActivityVasiliy Burov, oscd.community · Windows

criticalPotential Conti Ransomware Activityfrack113 · Windows

criticalWannaCry Ransomware ActivityFlorian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · Windows

highLynx Ransomware Execution PatternSwarup-Ingale · Windows

highRenamed Gpg.EXE ExecutionNasreddine Bencherchali (Nextron Systems), frack113 · Windows

highSuspicious Reg Add BitLockerfrack113 · Windows

mediumPortable Gpg.EXE Executionfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows