Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation

## Executive summary: A user-initiated ransomware attempt at QNET used the legitimate Windows utility mshta.exe (living-off-the-land) to retrieve a remote payload. Microsoft Defender detected suspicious RunMRU-related command activity and, via automated correlation and the IsolateDevice playbook, isolated the endpoint within about 128 seconds, stopping further payload download, persistence, or lateral movement; the report emphasizes rapid containment, staff training, hardened scripting controls, and tested backups as key mitigations.