Threat report

www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations

https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/

Published on: www.microsoft.com

ATT&CK techniques those detections carry

T1033System Owner/User Discovery
T1021.002SMB/Windows Admin Shares
T1039Data from Network Shared Drive
T1048Exfiltration Over Alternative Protocol

5 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Copy From Or To Admin Share Or Sysvol Folder	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
User Discovery And Export Via Get-ADUser Cmdlet	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Computer Discovery And Export Via Get-ADComputer Cmdlet	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 5 of 5

Filter in the catalogue