Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

DefenderXDR - Devman Ransomware Detection

Dylan Evans@decksy

•updated Jul 4, 2025•1•0•64

KQL Query from file: DefenderXDR - Devman Ransomware Detection

Microsoft Sentinel (KQL)

Tags

DS0022 - File T1600 - Weaken Encryption T1547.001 - Registry Run Keys / Startup Folder T1552.002 - Credentials in Registry DS0009 - Process T1055.012 - Process Hollowing T1486 - Data Encrypted for Impact TA0005 - Defense Evasion TA0006 - Credential Access TA0003 - Persistence TA0004 - Privilege Escalation TA0040 - Impact File Event Registry Event Process Event Malware Detected File Encryption Detected Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?