Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Ransomware hits healthcare - Backup deletion

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•1•0•15

List alerts flagging attempts to delete backup files.

Microsoft Sentinel (KQL)

Tags

T1485 - Data Destruction T1070.004 - File Deletion TA0040 - Impact TA0005 - Defense Evasion M1053 - Data Backup T1107 - File Deletion S1139 - INC Ransomware S1180 - BlackByte Ransomware S1181 - BlackByte 2.0 Ransomware S0195 - SDelete DS0022 - File T1486 - Data Encrypted for Impact S0357 - Impacket T1211 - Exploitation for Defense Evasion T1622 - Debugger Evasion TA0007 - Discovery File Deletion Data Exfiltration Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?