Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Devman – SMB Admin-Share Lateral Movement Preceding Web Defacement

Devman Lateral Movement Sentinel
MITRE ATT&CK
SMB/Windows Admin Shares
Data Source
DeviceNetworkEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (devman)
What This Detects
Devman's confirmed TTPs center on SMB admin-share lateral movement followed by web defacement rather than pure encryption – flags SMB connections followed by writes into a web root on the same host.
Query
let smb = DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 445
| project DeviceName, RemoteIP, SmbTime = Timestamp;
let webWrite = DeviceFileEvents
| where Timestamp > ago(1d)
| where FolderPath has_any ("wwwroot","htdocs","public_html")
| where ActionType in ("FileCreated","FileModified")
| project DeviceName, WebFile = FileName, WriteTime = Timestamp;
smb
| join kind=inner webWrite on DeviceName
| where WriteTime - SmbTime between (0min .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.