Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Dispossessor – Bulk File Access/Copy Without Corresponding Encryption Activity

Dispossessor Exfiltration Sentinel
MITRE ATT&CK
Exfiltration to Cloud Storage
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (dispossessor) – no group-specific tool/TTP telemetry on file; generic pure-extortion detection logic
What This Detects
Dispossessor operates as a data broker/pure-extortion actor rather than deploying an encryptor, so hunting must focus on the exfiltration stage: unusually high-volume file copy/rename activity across many folders with no follow-on mass-encryption pattern.
Query
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileCopied","FileRenamed")
| summarize FilesTouched = count(), DistinctFolders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where FilesTouched > 5000 and DistinctFolders > 20

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.