Mass VM power-off events from cloud management platform (IDCF ransomware shutdown
Detects when a large number of virtual machines are powered off by a single user or initiator within a short timeframe, which can be an indicator of malicious availability interruption or virtualization disruption (such as ransomware preparation).
Splunk (SPL)
