DETECTION OVERVIEW
Risk Factors
Large-scale file encryption can be performed without sophisticated tools, but an attacker must have valid permissions to access and encrypt files on a shared file server. This technique can help an attacker lock down access to files or obfuscate file content.
The system might change the risk score for this detection.
Kill Chain
Risk Score
78
After an attacker obtains a valid set of credentials to a file share, they can proceed with malicious activity that might be overlooked as normal file encryption operations. Examples of normal file encryption include file compression. Examples of malicious file encryption include ransomware malware.