Watch it run: the network scan 45+ ransomware groups use

Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.

If you read the June issue, you know the three network scanners 45+ ransomware groups reach for during discovery: SoftPerfect NetScan, Advanced IP Scanner and Advanced Port Scanner.

Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For

For the video I ran the scan again, this time through a ligolo-ng pivot.

What the video adds over the issue:

1. The scan landing in Defender Advanced Hunting (KQL), and the same sweep in Elastic ES|QL.

2. How I tell an admin running a scanner from an operator doing discovery.

3. A pivot trap: the operator came in through a ligolo-ng tunnel, so the victim logged the pivot host as the RDP source, not the attacker’s machine.

The lab path in the video: the operator pivots through app01, so WKST01 logs the RDP source as 10.2.20.10, not Kali.