Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect human-operated ransomware attacks that use RDP

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•68

KQL Query

Microsoft Sentinel (KQL)

Tags

T1076 - Remote Desktop Protocol T1021 - Remote Services T1078 - Valid Accounts T1087 - Account Discovery T1566 - Phishing TA0008 - Lateral Movement TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery S1139 - INC Ransomware S1180 - BlackByte Ransomware S1181 - BlackByte 2.0 Ransomware T1486 - Data Encrypted for Impact T1059 - Command and Scripting Interpreter T1053 - Scheduled Task/Job TA0040 - Impact S0357 - Impacket T1490 - Inhibit System Recovery TA0002 - Execution Remote Access Session Network Connection Logon Event Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?