Mass Deletion of Backup/Archive Data Across Multiple Hosts (Gunra)
Detects mass deletion of files related to backups, archives, or disaster recovery across multiple distinct devices within a short timeframe. This behavior is indicative of an adversary attempting to destroy backup infrastructure to prevent system recovery following a disruptive event such as ransomware deployment.
Microsoft Sentinel (KQL)
