Kyber Ransomware Hyper-V VM Termination
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
Microsoft Sentinel (KQL)
