diff --git a/impact/README.md b/impact/README.md index bc8fa81..83c5ca9 100644 --- a/impact/README.md +++ b/impact/README.md @@ -8,11 +8,11 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti * **Component Firmware** [E1109](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md) * **Compromise Data Integrity** [M0016](https://github.com/MBCProject/mbc-markdown/blob/master/impact/compromise-data.md) * **Data Destruction** [E1485](https://github.com/MBCProject/mbc-markdown/blob/master/impact/data-destruction.md) +* **Data Encrypted for Impact** [E1486](https://github.com/MBCProject/mbc-markdown/blob/master/impact/encrypt-impact.md) * **Denial of Service** [M0033](https://github.com/MBCProject/mbc-markdown/blob/master/impact/denial-of-service.md) * **Destroy Hardware** [M0017](https://github.com/MBCProject/mbc-markdown/blob/master/impact/destroy-hardware.md) * **Disk Content Wipe** [T1488](https://github.com/MBCProject/mbc-markdown/blob/master/impact/disk-content-wipe.md) * **Disk Structure Wipe** [T1487](https://github.com/MBCProject/mbc-markdown/blob/master/impact/disk-structure-wipe.md) -* **Encrypt Files for Impact** [E1486](https://github.com/MBCProject/mbc-markdown/blob/master/impact/encrypt-impact.md) * **Endpoint Denial of Service** [T1499](https://github.com/MBCProject/mbc-markdown/blob/master/impact/endpoint-denial-of-service.md) * **Exploit Kit Behavior** [E1190](https://github.com/MBCProject/mbc-markdown/blob/master/impact/exploit-kit-behavior.md) * **Exploit Software** [E1203](https://github.com/MBCProject/mbc-markdown/blob/master/execution/exploit-software.md) diff --git a/impact/encrypt-impact.md b/impact/encrypt-impact.md index 25611be..fc2d75e 100644 --- a/impact/encrypt-impact.md +++ b/impact/encrypt-impact.md @@ -5,8 +5,8 @@ |**Related ATT&CK Technique(s)**|[Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/), [Encrypt Files (Mobile)](https://attack.mitre.org/techniques/T1471/)| -Encrypt Files for Impact -======================== +Data Encrypted for Impact +========================= Malware may encrypt files stored on the system to prevent user access until a ransom is paid and/or to interrupt system availability. The encryption process usually iterates over all letter drives in the system (except for CD drives) and then recursively encrypts all files with specific suffixes. See ATT&CK: [**Data Encrypted for Impact**](https://attack.mitre.org/techniques/T1486/) and [**Encrypt Files (Mobile)**](https://attack.mitre.org/techniques/T1471/).