Ransomware Self-Deletion Sequence (01flip)
This rule detects a specific sequence of commands often used by ransomware, particularly the '01flip' variant, to self-delete after execution. The sequence involves 'ping.exe' for a delay, 'fsutil.exe' to zero out file data, and 'cmd.exe' to delete files. The rule correlates these events within a short timeframe, initiated by the same process on a given device.
Microsoft Sentinel (KQL)
