pre-encryption defense evasion and lateral movement

// Hunt: Rhysida-style pre-encryption defense evasion and lateral movement
// Covers shadow copy deletion, log clearing, Rclone exfiltration staging, and PsExec service execution
let lookback = 7d;
let AntiRecovery = dynamic(['delete shadows', 'shadowcopy delete', 'resize shadowstorage', 'recoveryenabled no']);
let LogClear = dynamic(['wevtutil cl', 'Clear-EventLog', 'Remove-EventLog']);
let Exfil = dynamic(['rclone', 'mega.io', 'mega.nz', 'transfer.sh']);
union isfuzzy=true
(DeviceProcessEvents
 | where TimeGenerated >= ago(lookback)
 | where ProcessCommandLine has_any (AntiRecovery, LogClear, Exfil)
 | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
),
(DeviceEvents
 | where TimeGenerated >= ago(lookback)
 | where ActionType == 'ServiceInstalled'
 | where AdditionalFields has 'psexesvc' or FileName =~ 'PSEXESVC.exe'
 | project TimeGenerated, DeviceName, ActionType, FileName, AdditionalFields, InitiatingProcessAccountName
)
| order by TimeGenerated asc

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.