Suspicious File System Enumeration (Pre-Encryption)
This rule detects suspicious file system enumeration activities that often precede ransomware encryption. It specifically looks for a high volume of command-line executions of 'dir /s', 'dir /r', or 'tree' commands within a short timeframe (5 minutes) on a single computer by a single account. These commands are commonly used by adversaries to discover files and directories before encrypting them.
Microsoft Sentinel (KQL)
