Gentlemen Ransomware Enumerates Cluster Shared Volumes and Mapped Drives
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
Microsoft Sentinel (KQL)
