wadhrama-credential-dump

This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance. The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials. Other techniques used by the group associated with Wadhrama are listed under See also. Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama