• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Imminent Ransomware

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•33

    Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.

    Microsoft Sentinel (KQL)

    Tags

    T1562 - Impair DefensesT1562.004 - Disable or Modify System FirewallT1562.001 - Disable or Modify ToolsT1546 - Event Triggered ExecutionT1053.005 - Scheduled TaskT1547.001 - Registry Run Keys / Startup FolderT1083 - File and Directory DiscoveryT1059 - Command and Scripting InterpreterT1089 - Disabling Security ToolsT1490 - Inhibit System RecoveryTA0005 - Defense EvasionTA0004 - Privilege EscalationTA0003 - PersistenceTA0002 - ExecutionTA0040 - ImpactTA0007 - DiscoveryProcess EventCommand ExecutionPowershell Script ExecutionRegistry Value SetService DeletedScheduled Task CreatedFile ModificationWindowsWindows Defender AvWindows Advanced FirewallWindows Task Scheduler Servicekqltactic:Ransomware

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?