Threat Hunting with Microsoft Defender XDR: Reconstructing a Ransomware Intrusion

Reconstructing a multi-stage ransomware attack using Microsoft Defender telemetry and KQL, covering reconnaissance, credential discovery, persistence, staging, and impact