Payouts King Pre-Ransomware Process and File Discovery Reconnaissance
Detects high-frequency reconnaissance activity on endpoints involving process enumeration and file/directory discovery. This behavior is commonly observed in the pre-ransomware phase as adversaries map out the environment, and is consistent with TTPs employed by threat actors such as BlackBasta, including the use of native administrative tools (e.g., tasklist, dir, tree, net share) and PowerShell commands for discovery.
Microsoft Sentinel (KQL)
