Gentlemen RaaS Activity Detection

Aamir Muhammad@Aamir

•updated Jul 3, 2026•7•1•45

Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.