Advanced hunting in Microsoft Defender XDR to detect ransomware indicators

Microsoft's documentation shows how to actively detect common pre-ransomware behaviors via advanced hunting queries that can run on Defender XDR (and Microsoft Sentinel). The focus is on actions that commonly occur before encryption, including process terminations, service disablement, deletion of shadow copies and backups, event log clearing, and changes to boot configuration.

The article provides multiple concrete Kusto Query Language (KQL) examples for detecting individual signs. Examples include a query to detect 10 or more process terminations by taskkill.exe, a similar detection for net stop, a query to detect operations using cipher.exe with the /w flag that wipe multiple drives in a short time, and a query to detect 10 or more log deletions by wevtutil.

Because single detections often generate many false positives, the documentation also presents a method that aggregates and weights multiple indicators—a unified query—to check whether multiple attack indicators appear on the same endpoint and thus identify high-priority devices. The documentation is intended for direct copying and execution in Microsoft's advanced hunting editor.

A caution notes that many of the behaviors described can also occur during legitimate administrative activity, so it is recommended to verify whether multiple indicators are present on the same host. Accessing the document requires authentication, and running the queries requires a Defender XDR environment and appropriate permissions.