T1486 Data Encrypted for Impact

2 threats tracked by Spectrum Delta use this technique.

T1486 on MITRE ATT&CK →

• Majinahanashi ransomware

  Data encrypted for impact: striped, tuned, low-priority encryption

  EDR/Sysmon file-write telemetry: mass renames to the .MAJIN extension and writes to files, decoy-file modification attempts; the stripe/priority/SSD-HDD tuning details are analyzed capabilities from the primary, not claims about what generic telemetry surfaces

  Seen in: Windows EDR / Sysmon process+file

• Heartbreaker macOS ransomware

  Data encrypted for impact: in-place Downloads-folder encryption

  Endpoint Security modified-file close events provide the file-write visibility, but the entropy verdict requires separate file-content/statistical analysis — Endpoint Security does not itself provide an entropy determination; the primary's tested heuristic (RansomWhere?) performs that analysis on observed writes

  Seen in: macOS Endpoint Security — file events