[RW] - Detect Prefetch Deletion Attempt
A typical technique used by ransomware operators is the deletion of Prefetch files, which track recently executed programs . By running commands like 'del C:\Windows\Prefetch\*.pf', attackers attempt to erase forensic traces of tools they’ve used. This behavior is aimed at hindering investigation and slowing down incident response.
Microsoft Sentinel (KQL)
