T1486Impact
Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for…
CVEs15
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.15
Reports0
Detections
17 Sigma rules tagged T1486Data Encrypted for ImpactT148617 general rules
- LockerGoga Ransomware Activitycriticalstable
- Antivirus - Ransomware Signaturecriticaltest
- Potential Conti Ransomware Activitycriticaltest
- WannaCry Ransomware Activitycriticaltest
- BlueSky Ransomware Artefactshightest
- Load Of RstrtMgr.DLL By A Suspicious Processhightest
- Renamed Gpg.EXE Executionhightest
- Suspicious Reg Add BitLockerhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Data Encrypted for Impact
15 CVEs, by priority. Each link shows its badge.- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%90.0priority
- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%89.4priority
- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.4%Top 0.06%86.8priority
- CVE-2021-45046Apache Log4j2 Deserialization of Untrusted Data VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 9.0T1059Command and Scripting InterpreterT1486Data Encrypted for Impact2 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%85.4priority
- CVE-2016-1019Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool TransferT1486Data Encrypted for Impact4 reportsMITRE CTID mapping of the KEV entry · follow-on activity22.3%Top 2.3%83.4priority
- CVE-2023-38831RARLAB WinRAR Code Execution VulnerabilityRARLAB · WinRARKEVRansomwarePublic exploitHigh · 7.8T1204User ExecutionT1053Scheduled Task/Job+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%82.3priority
- CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityVeeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote ServicesT1059.003Windows Command Shell+4 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity80.6%Top 0.38%82.0priority
- CVE-2015-8651Adobe Flash Player Integer Overflow VulnerabilityAdobe · Flash PlayerKEVHigh · 8.8T1189Drive-by CompromiseT1105Ingress Tool Transfer+1 more · 3 reportsMITRE CTID mapping of the KEV entry · follow-on activity67.7%Top 0.69%81.8priority
- CVE-2021-42258BQE BillQuick Web Suite SQL Injection VulnerabilityBQE · BillQuick Web SuiteKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1486Data Encrypted for ImpactMITRE CTID mapping of the KEV entry · follow-on activity75.2%Top 0.49%79.8priority
- CVE-2023-28252Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity48.9%Top 1.1%78.2priority
- CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity99.4%Top 0.06%78.2priority
- CVE-2023-0669Fortra GoAnywhere MFT Remote Code Execution VulnerabilityFortra · GoAnywhere MFTKEVRansomwarePublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1210Exploitation of Remote Services+1 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%78.0priority
- CVE-2019-11634Citrix Workspace Application and Receiver for Windows Remote Code Execution VulnerabilityCitrix · Workspace Application and Receiver for WindowsKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity8.1%Top 5.2%77.7priority
- CVE-2009-3960Adobe BlazeDS Information Disclosure VulnerabilityMITRE CTID mapping of the KEV entry · primary impact90.1%Top 0.2%77.5priority
- CVE-2022-22947VMware Spring Cloud Gateway Code Injection VulnerabilityVMware · Spring Cloud GatewayKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · follow-on activity98.3%Top 0.08%70.0priority