What is the Impact tactic in MITRE ATT&CK?
Impact is the attacker's end goal made visible: encrypting data for ransom, wiping systems, stopping services, corrupting backups, defacing websites, or manipulating data and industrial processes. In ATT&CK it also includes inhibiting recovery, such as deleting shadow copies and backup catalogues. By this stage containment is urgent and evidence is under pressure. Prevention lies earlier: offline backups the attacker cannot reach, separation between IT and production, and alerts on the steps that come before. Encryption itself happens on hosts; where it hits network shares, one client reads and rewrites large amounts of data in a short time. NetSenX has no dedicated detection for the encryption step and does not stop it; it watches the stages before, such as beaconing, scanning, lateral movement and unusual outbound volume, on every plan.