Lateral Movement & Pre-Ransomware Staging Hunt

// DIREWOLF pre-ransomware staging hunt: remote exec + mass file activity + archive tooling
let lookback = 14d;
let staging_window = 3d;
let SuspectHosts =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
       or FileName in~ ("psexec.exe", "PsExec64.exe", "PSEXESVC.exe", "rclone.exe", "7z.exe", "7za.exe", "rar.exe")
    | summarize FirstSeen = min(Timestamp), Toolset = make_set(FileName), CmdLines = make_set(ProcessCommandLine) by DeviceName, AccountName
    | project DeviceName, AccountName, FirstSeen, Toolset, CmdLines;
SuspectHosts
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(staging_window)
    | where RemotePort in (445, 139, 3389, 5985, 5986)
    | where RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172."
    | summarize InternalTargets = dcount(RemoteIP), Ports = make_set(RemotePort) by DeviceName
    | where InternalTargets > 15
) on DeviceName
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(staging_window)
    | where FileName endswith ".vss" or FolderPath has "Volume Shadow Copy"
       or (InitiatingProcessCommandLine has_any ("vssadmin", "bcdedit", "wbadmin"))
    | summarize ShadowTamperEvents = count(), TamperCmds = make_set(InitiatingProcessCommandLine) by DeviceName
) on DeviceName
| project DeviceName, AccountName, FirstSeen, Toolset, InternalTargets, Ports, ShadowTamperEvents, TamperCmds, CmdLines
| order by ShadowTamperEvents desc, InternalTargets desc;

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.