Impact

Wipers and secure-delete operations that destroy data with no intent of recovery.

Detect it with
Raw disk writes by unexpected processes; SDelete-style patterns across many hosts at once.

Ransomware encrypting files across endpoints and servers to force payment.

Detect it with
Mass file rename/write bursts, ransom note creation, canary file modification.

Stopping databases, backup agents, and security services so files can be encrypted cleanly.

Detect it with
net stop / sc stop against database and backup services in rapid sequence.

Deleting shadow copies, disabling recovery mode, and destroying backups before encrypting.

Detect it with
vssadmin delete shadows, wbadmin delete catalog, bcdedit recovery flags — treat every one as critical.

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Detect it with
Monitor internal and external websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation.

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.

Detect it with
System firmware manipulation may be detected. Log attempts to read/write to BIOS and compare against known patching behavior.

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms.

Detect it with
Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources.

Flooding the network or an application to make it unavailable, sometimes as a distraction.

Detect it with
Bandwidth saturation, connection-table exhaustion, upstream provider alerts.

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Detect it with
Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device.

Detect it with
Use process monitoring to monitor the execution and command line parameters of binaries involved in shutting down or rebooting systems. Windows event logs may also designate activity associated with a shutdown/reboot, ex.

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Detect it with
Use process monitoring to monitor the execution and command line parameters of binaries involved in deleting accounts or changing passwords, such as use of Net.

Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.

Detect it with
Look for attempts to read/write to sensitive locations like the partition boot sector, master boot record, disk partition table, or BIOS parameter block/superblock. Monitor for direct access read/write attempts using the \\\\.\\ notation.

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Detect it with
Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values. With some critical processes involving transmission of data, manual or out-of-band integrity checking may be useful for identifying manipulated data.

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.