During triage, an EDR alert shows a suspicious process enumerating user documents, overwriting them with encrypted contents, renaming files with a new extension, and dropping a ransom note in each folder. The same process did not exploit a service, add a scheduled task, or disable logging. Which MITRE ATT&CK tactic best describes this observed behavior?

MITRE ATT&CK organizes adversary behavior into tactics that describe the immediate objective behind a technique. When a process encrypts user files, changes extensions, and creates ransom notes, the objective is to damage availability and integrity, so the observed behavior belongs to the Impact tactic. In an incident response timeline, you classify that activity separately from how the intrusion began or how the adversary maintained access. Initial Access is wrong because it describes the first foothold, such as exploiting an exposed service or phishing a credential, not the destructive payload after execution. Persistence is wrong because it describes mechanisms that let the adversary remain on the system, such as scheduled tasks, startup items, or service modifications, rather than file destruction. Defense Evasion is wrong because it covers attempts to avoid detection, such as obfuscation, credential theft for logins, or disabling security controls, and it does not define the ransomware effect itself. Exam caveat: a single ransomware incident can contain techniques from many tactics, so classify the specific observed action by its adversary goal rather than labeling the whole intrusion. Operational check: when reviewing EDR or SIEM ransomware telemetry, tag file encryption and ransom-note creation as Impact, then map separate indicators for initial access, persistence, and evasion to their own tactics.