AI-built ransomware toolkit AD discovery burst
This rule detects a burst of network discovery activity from tools linked to DIY ransomware kits advertised with AI themes. Attackers use these tools to identify machines before encrypting files. Fast, repeated discovery from a single source is a serious warning sign. The rule specifically looks for multiple distinct discovery tools (nltest.exe, net.exe, net1.exe, dsquery.exe, adfind.exe, whoami.exe, ipconfig.exe) executed from common user-writable or temporary directories within a short timeframe.
Microsoft Sentinel (KQL)
