Microsoft Defender XDR
GeneralHunt for ransomware
In brief
The article was updated with a new introductory description and additional explanations for the taskkill.exe process-stop and cipher.exe multi-drive data-deletion queries. The publication date was also updated.
What Defender admins need to know
Security teams get clearer context for interpreting these ransomware-related hunting queries.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Hunt for ransomware
[!INCLUDE Microsoft Defender XDR rebranding]This article shows you how to use advanced hunting queries in Microsoft Defender XDR to proactively detect signs of ransomware activity on devices. The queries target common pre-encryption behaviors—such as stopping processes, disabling services, deleting backups, and clearing event logs—and include a consolidated query that weighs multiple indicators to help you prioritize the devices that need immediate attention.
Ransomware threat overview
[!INCLUDE Microsoft Defender XDR rebranding]
Ransomware evolved rapidly from being simple commodity malware affecting individual computer users to an enterprise threat that is severely impacting industries and government institutions. Microsoft Defender XDR provides many capabilities that detect and block ransomware and associated intrusion activities. However, proactively checking for signs of compromise can help keep your network protected.
Stopping multiple processes using taskkill.exe
This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. Ransomware often uses taskkill.exe to terminate security tools or business applications before encryption. Run the taskkill.exe process-stop detection query
// Find attempts to stop processes using taskkill.exe
Deletion of data on multiple drives using cipher.exe
This query checks for attempts to delete data on multiple drives using cipher.exe. This activityDeleting data on multiple drives using cipher.exe is typically done by ransomware to prevent recovery of data after encryption. Run the cipher.exe multi-drive data deletion detection query
// Look for cipher.exe deleting data from multiple drives
@@ -20,17 +20,19 @@ appliesto: - Microsoft Defender XDR - Microsoft Sentinel in the Microsoft Defender portal ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted #customer intent: As a security analyst, I want to use advanced hunting queries to proactively detect ransomware activity on devices so that I can identify and respond to threats before encryption occurs. --- # Hunt for ransomware -[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]+This article shows you how to use advanced hunting queries in Microsoft Defender XDR to proactively detect signs of ransomware activity on devices. The queries target common pre-encryption behaviors—such as stopping processes, disabling services, deleting backups, and clearing event logs—and include a consolidated query that weighs multiple indicators to help you prioritize the devices that need immediate attention. ## Ransomware threat overview +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]+ Ransomware evolved rapidly from being simple commodity malware affecting individual computer users to an enterprise threat that is severely impacting industries and government institutions. [Microsoft Defender XDR](microsoft-365-defender.md) provides many capabilities that detect and block ransomware and associated intrusion activities. However, proactively checking for signs of compromise can help keep your network protected. > [!TIP]@@ -58,7 +60,7 @@ Many activities that constitute ransomware behavior, including stopping processe ### Stopping multiple processes using _taskkill.exe_ -This query checks for attempts to stop at least 10 separate processes using the _taskkill.exe_ utility. [Run the taskkill.exe process-stop detection query](https://security.microsoft.com/hunting?query=H4sIAAAAAAAEAI2RS2vCUBCFz7rgfwiuIkit3eumVSgtpYvuS9SLDTY2eLUvxN_eb8YHKlFkyNzJzDkn505aailRX7mmGlFlmhNBhUrOSGeuT3L0s6QqNaMagolEcMyCbApjx2e8TYhcH8Q1mB-emq50z_lF39gvBzo9-gEF-6Yhlyh9653ejCfRK6zCsaZfuJOu-x2jkqqN-0Yls-8-gp6dZ52OVuT6Sad1plulyN0KIkMt15_zt7zHDe8OBwv3btoJToa7Tnp0T8Ou9WzfT761gPOm3_FQ16Zxp2qcCdg33_rlyokG-iXv7_4BRNMnhkortmvTW6rqnZ7bgP2Vtm70D3d9wcFaAgAA&runQuery=true&timeRangeId=week)+This query checks for attempts to stop at least 10 separate processes using the _taskkill.exe_ utility. Ransomware often uses _taskkill.exe_ to terminate security tools or business applications before encryption. [Run the taskkill.exe process-stop detection query](https://security.microsoft.com/hunting?query=H4sIAAAAAAAEAI2RS2vCUBCFz7rgfwiuIkit3eumVSgtpYvuS9SLDTY2eLUvxN_eb8YHKlFkyNzJzDkn505aailRX7mmGlFlmhNBhUrOSGeuT3L0s6QqNaMagolEcMyCbApjx2e8TYhcH8Q1mB-emq50z_lF39gvBzo9-gEF-6Yhlyh9653ejCfRK6zCsaZfuJOu-x2jkqqN-0Yls-8-gp6dZ52OVuT6Sad1plulyN0KIkMt15_zt7zHDe8OBwv3btoJToa7Tnp0T8Ou9WzfT761gPOm3_FQ16Zxp2qcCdg33_rlyokG-iXv7_4BRNMnhkortmvTW6rqnZ7bgP2Vtm70D3d9wcFaAgAA&runQuery=true&timeRangeId=week) ```kusto // Find attempts to stop processes using taskkill.exe@@ -83,7 +85,7 @@ DeviceProcessEvents ``` ### Deletion of data on multiple drives using _cipher.exe_-This query checks for attempts to delete data on multiple drives using _cipher.exe_. This activity is typically done by ransomware to prevent recovery of data after encryption. [Run the cipher.exe multi-drive data deletion detection query](https://security.microsoft.com/hunting?query=H4sIAAAAAAAEAI1SXUvDQBCcZ8H_cOQpgWLoD7AvVUEo4oPvElO1pblUcmn9QPztzk6TEuEsIdzdZndndm73cuRwWGDLb0PrhWfDs8Qab1jhmX8X3D-4HJbcK66W0Rqv8hT8K4RsiPW0PHbMasVQdbiGf3vaAec4wxWtPT0lz3vhSsUCrpVVE33I_Cb6vdNhTA9EeeVaVc8KDjOugmq2SDFlrSyKvCHS1NwJZ55L_HBPondNGDGWXP2JdyMnv927UnXHWwf6l4MunupXTOPfXszVT8_smriFOCxrRU-QclOQDLgCNRwQ1u8vZc8H2o1xp-7a7U1NefSko6pnmKjakNVi4chpiA39j-rGeF6HJ3xyH76NW2ZMFLGsNDJ9i05pZSPmVdDfq-jncfqtOuU5zSuQz6Zq92w7Hfbm-9cUm-d_vZ9J9S81O2KIfAMAAA&runQuery=true&timeRangeId=week)+This query checks for attempts to delete data on multiple drives using _cipher.exe_. Deleting data on multiple drives using _cipher.exe_ is typically done by ransomware to prevent recovery of data after encryption. [Run the cipher.exe multi-drive data deletion detection query](https://security.microsoft.com/hunting?query=H4sIAAAAAAAEAI1SXUvDQBCcZ8H_cOQpgWLoD7AvVUEo4oPvElO1pblUcmn9QPztzk6TEuEsIdzdZndndm73cuRwWGDLb0PrhWfDs8Qab1jhmX8X3D-4HJbcK66W0Rqv8hT8K4RsiPW0PHbMasVQdbiGf3vaAec4wxWtPT0lz3vhSsUCrpVVE33I_Cb6vdNhTA9EeeVaVc8KDjOugmq2SDFlrSyKvCHS1NwJZ55L_HBPondNGDGWXP2JdyMnv927UnXHWwf6l4MunupXTOPfXszVT8_smriFOCxrRU-QclOQDLgCNRwQ1u8vZc8H2o1xp-7a7U1NefSko6pnmKjakNVi4chpiA39j-rGeF6HJ3xyH76NW2ZMFLGsNDJ9i05pZSPmVdDfq-jncfqtOuU5zSuQz6Zq92w7Hfbm-9cUm-d_vZ9J9S81O2KIfAMAAA&runQuery=true&timeRangeId=week) ```kusto // Look for cipher.exe deleting data from multiple drives