defensivedepth
09/29/2024, 5:48 PMThe threat actor also utilized open-source tools like ossec-win32 and OSQuery to query additional endpoint information.
https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/