Possible ransoware activity
The query aim to identify a typical ransomware behavior which is file encryption follow by file deletion
Microsoft Sentinel (KQL)

The query aim to identify a typical ransomware behavior which is file encryption follow by file deletion

Already have an account?