wadhrama-ransomware

This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance. The following query checks for possible Wadhrama-related activity, by searching for attempts to establish RDP persistance via the registry. Other techniques used by the group associated with Wadhrama are listed under See also. Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama