VanHelsing Ransomware - Remote Execution via SMB
Detects a pattern of behavior associated with VanHelsing ransomware's lateral movement, where an executable is written to a device over SMB and then executed shortly after. This is indicative of remote code execution techniques like those using PsExec.
Microsoft Sentinel (KQL)
