Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Sarcoma – Advanced IP Scanner Sweep Preceding Bulk File Discovery

Sarcoma Discovery Sentinel
MITRE ATT&CK
File and Directory Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools/ttps dataset (sarcoma)
What This Detects
Sarcoma runs Advanced IP Scanner for network discovery and, per its TTPs, follows with broad file/directory enumeration – correlating the two narrows a generic recon signal to a Sarcoma-consistent chain.
Query
let scan = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "advanced_ip_scanner"
| project DeviceName, ScanTime = Timestamp;
let discovery = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("cmd.exe","powershell.exe") and ProcessCommandLine has_any ("dir /s","Get-ChildItem -Recurse")
| project DeviceName, DiscoTime = Timestamp;
scan
| join kind=inner discovery on DeviceName
| where DiscoTime - ScanTime between (0min .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.