Azure-Sentinel
Azure-Sentinel copied to clipboard
Update hunt query Possible Ransomware Related Destruction Activity
Change(s):
- Adds a filter to include WMIC events where shadow copies are deleted
Reason for Change(s):
- Updating query for better detections
Version Updated:
- N/A
Testing Completed:
- Yes
Checked that the validations are passing and have addressed any issues that are present:
- Yes