All Detections

Modifying the registry to add a ransom message notification

Azure Sentinel@AzureSentinel
updated Jun 17, 202509

Identify registry modifications that is indicative of a ransom note tied to DEV-0270.

Microsoft Sentinel (KQL)