Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Devman – SMB Admin-Share Lateral Movement Preceding Web Defacement

Devman Lateral Movement Sentinel
MITRE ATT&CK
SMB/Windows Admin Shares
Data Source
DeviceNetworkEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (devman)
What This Detects
Devman's confirmed TTPs center on SMB admin-share lateral movement followed by web defacement rather than pure encryption – flags SMB connections followed by writes into a web root on the same host.
Query
let smb = DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 445
| project DeviceName, RemoteIP, SmbTime = Timestamp;
let webWrite = DeviceFileEvents
| where Timestamp > ago(1d)
| where FolderPath has_any ("wwwroot","htdocs","public_html")
| where ActionType in ("FileCreated","FileModified")
| project DeviceName, WebFile = FileName, WriteTime = Timestamp;
smb
| join kind=inner webWrite on DeviceName
| where WriteTime - SmbTime between (0min .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.