Malware Detection Exclusions List Updated | Microsoft Sentinel Analytic Rules

Back


Id	401e91cb-b53f-41a5-b066-1c028b3b51db
Rulename	Malware Detection Exclusions List Updated
Description	Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.
Severity	Medium
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Detection_Exclusions_List_Updated.yaml
Version	1.0.1
Arm template	401e91cb-b53f-41a5-b066-1c028b3b51db.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 42280
| project
  Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
   MessageDetails = Description,
   Severity = SeverityDescription
| project Date, DataSource, EventId, UserName,MessageDetails,Severity

YAML

name: Malware Detection Exclusions List Updated
triggerOperator: gt
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42280
  | project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
     MessageDetails = Description,
     Severity = SeverityDescription
  | project Date, DataSource, EventId, UserName,MessageDetails,Severity
queryFrequency: 5m
description: Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.
id: 401e91cb-b53f-41a5-b066-1c028b3b51db
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.1
kind: Scheduled
customDetails:
  VbrHostName: DataSource
  Severity: Severity
  EventId: EventId
  Date: Date
  MessageDetails: MessageDetails
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Detection_Exclusions_List_Updated.yaml
relevantTechniques: []
tactics: []

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/401e91cb-b53f-41a5-b066-1c028b3b51db')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/401e91cb-b53f-41a5-b066-1c028b3b51db')]",
      "properties": {
        "alertRuleTemplateName": "401e91cb-b53f-41a5-b066-1c028b3b51db",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.",
        "displayName": "Malware Detection Exclusions List Updated",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Detection_Exclusions_List_Updated.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 42280\n| project\n  Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    UserName = user,\n   MessageDetails = Description,\n   Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}