Gentlemen RaaS EDR Killer Staging Directory Activity
Detects file creation or process execution originating from or referencing a folder named 'GentlemenCollection', which is a known staging directory used by the Gentlemen RaaS EDR killer framework prior to ransomware encryption.
Microsoft Sentinel (KQL)
