Detecting Ransomware Recon with Zero Trust Telemetry
Port scanning is a common precursor to ransomware attacks, typically occurring during the reconnaissance phase. With Entra Global Secure Access deployed across your endpoints for zero-trust access, you can leverage KQL to detect port scan activity indicative of early-stage threat behavior.
Microsoft Sentinel (KQL)
