Sentinel / Microsoft Defender hunting queries built from each ransomware group's known tools and MITRE ATT&CK techniques. Use them as starting points for threat hunting — validate table/column names against your own workspace schema before turning any of these into a production alert rule.

• 8base 1
  • 8Base – Rootkit-Capable Process/Driver Killers (GMER, PCHunter, Process Hacker) Defense Evasion Sentinel T1489
• Akira 2
  • Akira – DLL Side-Loading via Signed Utility Binaries Defense Evasion Sentinel T1574.001
  • Akira – SharpHound/ldapdomaindump/ShareFinder Domain-Trust Enumeration Discovery Sentinel T1482
• Alphv 2
  • ALPHV/BlackCat – Rust Encryptor Invocation with Known CLI Flags Encryption / Impact Sentinel T1486
  • ALPHV/BlackCat – UAC Bypass Paired with Access-Token Impersonation Defense Evasion Sentinel T1548.002
• Avaddon 1
  • Avaddon – TDSSKiller Rootkit Scanner Repurposed to Disable AV/EDR Defense Evasion Sentinel T1211
• Babuk2 1
  • Babuk2 (Impersonator) – Credential-Stuffing Wave Following a Leak-Site Claim Initial Access Sentinel T1110.003
• Bianlian 2
  • BianLian – PingCastle/SharpShares Active Directory Assessment Abuse Discovery Sentinel T1482
  • BianLian – RDP Recognizer Credential Validation Preceding Mass RDP Logons Lateral Movement Sentinel T1021.001
• Blackbasta 2
  • Black Basta – Backstab EDR-Kill Driver Dropped Outside Program Files Defense Evasion Sentinel T1574.001
  • Black Basta – Email-Bombing Followed by Quick Assist Remote-Access Grant Initial Access Sentinel T1219
• Blackbyte 1
  • BlackByte – RTCore64.sys (GIGABYTE Driver) BYOVD Load Defense Evasion Sentinel T1211
• Blacksuit 1
  • BlackSuit – GPO Change Enabling RDP Across Multiple Hosts Persistence Sentinel T1484.001
• Cactus 1
  • Cactus – Chisel Tunnel Paired with Uncommon RMM Install (SuperOps/Splashtop) Command and Control Sentinel T1090
• Cloak 1
  • Cloak – High-Rate File Rename with Ransom-Note Drop (Generic Encryptor Behavior) Encryption / Impact Sentinel T1486
• Clop 2
  • Clop – DLL Injection Paired with Windows Event Log Clearing Defense Evasion Sentinel T1055.001
  • Clop – Suspicious Child Process from Internet-Facing File-Transfer Service Initial Access Sentinel T1190
• Conti 2
  • Conti – PowerView/SharpView Domain-Trust Enumeration Discovery Sentinel T1482
  • Conti – Rubeus Kerberos Abuse Followed by PsExec Lateral Movement Lateral Movement Sentinel T1021.002
• Devman 1
  • Devman – SMB Admin-Share Lateral Movement Preceding Web Defacement Lateral Movement Sentinel T1021.002
• Dispossessor 1
  • Dispossessor – Bulk File Access/Copy Without Corresponding Encryption Activity Exfiltration Sentinel T1567.002
• Dragonforce 1
  • DragonForce – Rapid Multi-Tool Network/AD Reconnaissance Discovery Sentinel T1018
• Everest 1
  • Everest – Cobalt Strike / Meterpreter Beacon Traffic Pattern Command and Control Sentinel T1071.001
• Fog 1
  • Fog – Certipy AD CS Enumeration Combined with Veeam Credential Harvesting Discovery Sentinel T1649
• Funksec 1
  • FunkSec – Mass Exploitation Attempt Against Internet-Facing Applications Initial Access Sentinel T1190
• Handala 1
  • Handala – Bulk File Access/Copy Without Corresponding Encryption Activity Exfiltration Sentinel T1567.002
• Hive 1
  • Hive – Recovery Disable (bcdedit) Paired with Windows Event Log Clearing Shadow Copy Deletion Sentinel T1490
• Hunters 1
  • Hunters International – RClone/WinSCP Bulk Transfer to External Endpoint Exfiltration Sentinel T1048
• Incransom 2
  • INC Ransom – AdFind/Advanced IP Scanner Active Directory Recon Discovery Sentinel T1482
  • INC Ransom – Restic / s5cmd Invoked for Covert Cloud Exfiltration Exfiltration Sentinel T1567.002
• Killsec 1
  • KillSec – High-Rate File Rename with Ransom-Note Drop Across Multiple Shares Encryption / Impact Sentinel T1486
• Lockbit2 1
  • LockBit 2.0 – New Group Policy Object Followed by Mass Scheduled-Task Deployment Lateral Movement Sentinel T1484.001
• Lockbit3 2
  • LockBit 3.0 – BloodHound/AdFind/Seatbelt Active Directory Recon Chain Discovery Sentinel T1087.002
  • LockBit 3.0 – Defender Control Disable Followed by Shadow Copy Deletion Shadow Copy Deletion Sentinel T1490
• Lockbit5 1
  • LockBit 5.0 – ESXi VM Power-Off Sequence Preceding VMDK Encryption Encryption / Impact Sentinel T1486
• Lynx 1
  • Lynx – Restic Utility Used for Staged Backup-Style Exfiltration Exfiltration Sentinel T1567.002
• Medusa 2
  • Medusa – Reboot into Safe Mode Followed by Security Service Stop Defense Evasion Sentinel T1489
  • Medusa – RevSocks/FRP/Ligolo Reverse Tunnel for Covert C2 Command and Control Sentinel T1572
• Meow 1
  • Meow – Bulk Data Staging for Resale (No Encryption Payload) Exfiltration Sentinel T1537
• Nightspire 1
  • Nightspire – Everything.exe Rapid File Search Preceding WinSCP/MEGA Transfer Discovery Sentinel T1083
• Noescape 1
  • NoEscape – TDSSKiller Rootkit Scanner (Inherited Avaddon Toolkit, Unconfirmed) Defense Evasion Sentinel T1211
• Play 2
  • Play Ransomware – EDR-Killer Driver Drop Ahead of AD Recon Defense Evasion Sentinel T1489
  • Play Ransomware – HandleKatz/Nanodump Stealthy LSASS Access Defense Evasion Sentinel T1003.001
• Pysa 2
  • Pysa – ADRecon Active Directory Enumeration Sweep Discovery Sentinel T1087.002
  • Pysa – SessionGopher Credential Harvesting Preceding Empire/Koadic Beacon Command and Control Sentinel T1105
• Qilin 2
  • Qilin – Nmap/Nping Scan Followed by NetExec Credential Spray Lateral Movement Sentinel T1046
  • Qilin – Vulnerable Driver Load for EDR Kill (BYOVD) Defense Evasion Sentinel T1211
• Ragnarlocker 1
  • RagnarLocker – Silent VirtualBox Deployment for EDR-Evading Encryption Defense Evasion Sentinel T1564.006
• Ransomhouse 1
  • RansomHouse – Dual-Key Encryption Pattern: Mass Rename with Two Ransom Notes Encryption / Impact Sentinel T1486
• Ransomhub 2
  • RansomHub – BadRentdrv2/ThreatFire Driver BYOVD Load Defense Evasion Sentinel T1211
  • RansomHub – Unapproved RMM Tool Install on Server Assets Command and Control Sentinel T1219
• Raworld 1
  • RA World – Toshiba Bluetooth Stack Driver (toshdpdb.exe) BYOVD Load Defense Evasion Sentinel T1211
• Rhysida 2
  • Rhysida – PowerView Recon Followed by Impacket-Based Lateral Movement Lateral Movement Sentinel T1021.002
  • Rhysida – wevtutil Log Clearing Paired with ntdsutil NTDS Extraction Defense Evasion Sentinel T1070
• Royal 1
  • Royal – Brute Ratel C4 Alongside NirSoft Credential-Recovery Suite Command and Control Sentinel T1071.001
• Safepay 2
  • SafePay – LLMNR/NBT-NS Poisoning for Credential Capture Lateral Movement Sentinel T1557.001
  • SafePay – Regsvr32/CMSTP Proxy Execution for Defense Evasion Defense Evasion Sentinel T1218.010
• Sarcoma 1
  • Sarcoma – Advanced IP Scanner Sweep Preceding Bulk File Discovery Discovery Sentinel T1083
• Sinobi 1
  • Sinobi – Public-Facing Exploit or Privileged Logon Followed by Rapid Service Creation Initial Access Sentinel T1190
• Snatch 1
  • Snatch – Reboot into Safe Mode Followed by Security Service Stop (Origin Case) Defense Evasion Sentinel T1489
• Stormous 1
  • Stormous – Web Shell Persistence via IIS Component Persistence Sentinel T1505.003
• Thegentlemen 3
  • The Gentlemen – Coerced Authentication (PetitPotam) Chained to NTLM Relay Lateral Movement Sentinel T1557
  • The Gentlemen – MANSPIDER Sensitive-String Share Crawler Discovery Sentinel T1135
  • The Gentlemen – Velociraptor DFIR Tool Deployed for Offensive C2 Command and Control Sentinel T1219
• Vicesociety 1
  • Vice Society – ntdsutil NTDS Dump Paired with Minidump-Based LSASS Access Lateral Movement Sentinel T1021.002
• Worldleaks 1
  • World Leaks – Bulk Data Staging Consistent with Inherited Hunters International Tooling Exfiltration Sentinel T1537