MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1486Data Encrypted for Impact

Impact

View on MITRE ATT&CK →

2 Queries

Mass File Encryption Detected — Ransomware Pattern

criticaltestingMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceFileEvents

DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| where FileName endswith_any (".encrypted", ".locked", ".crypt", ".enc", ".ransom", ".zzz", ".locky", ".cerber", ".zepto", ".thor")
| summarize RenamedCount = count(), FilesSample = make_set(FileName, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1m)
| where RenamedCount >= 50
| sort by RenamedCount desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

Tuning notes

Extend the endswith_any list with ransomware extensions relevant to current threat landscape. Legitimate encryption tools (7zip, BitLocker) should be excluded by InitiatingProcessFileName.

+ Add another query for this technique →