Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

ExploitGuardControlledFolderAccess

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•0•8

Total Controlled Folder Access events.

Microsoft Sentinel (KQL)

Tags

T1486 - Data Encrypted for Impact TA0040 - Impact T1650 - Acquire Access TA0001 - Initial Access T1108 - Redundant Access S1139 - INC Ransomware S1180 - BlackByte Ransomware S1181 - BlackByte 2.0 Ransomware TA0042 - Resource Development TA0005 - Defense Evasion TA0003 - Persistence T1022 - Data Encrypted TA0010 - Exfiltration File Event Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?