PowerShell AES File Encryption, Mass Rename, and Ransom Note Drop
This query detects PowerShell-based AES encryption activity followed by mass file rename/encryption indicators and ransom note creation within a correlated pre-defined timestamp.
Microsoft Sentinel (KQL)
