Malware Activity Detected | Microsoft Sentinel Analytic Rules

Back


Id	9a7c80ef-8dc2-4b07-834d-b9ca18d603f7
Rulename	Malware Activity Detected
Description	Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Activity_Detected.yaml
Version	1.0.2
Arm template	9a7c80ef-8dc2-4b07-834d-b9ca18d603f7.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 41600
| extend ActivityType = extract("ActivityType=\"([^\"]*)\"", 1, SyslogMessage)
| extend MachineDisplayName = extract("[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\s*\\(([^)]+)\\)", 1, Description)
| extend MachineUuid = extract("([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})", 1, Description)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
    ["Malware Detection Method"] = ActivityType,
    MessageDetails = Description,
    Severity = SeverityDescription,
    MachineDisplayName,
    MachineUuid

YAML

name: Malware Activity Detected
triggerOperator: gt
query: |
  Veeam_GetSecurityEvents
  | where instanceId == 41600
  | extend ActivityType = extract("ActivityType=\"([^\"]*)\"", 1, SyslogMessage)
  | extend MachineDisplayName = extract("[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\s*\\(([^)]+)\\)", 1, Description)
  | extend MachineUuid = extract("([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})", 1, Description)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
      ["Malware Detection Method"] = ActivityType,
      MessageDetails = Description,
      Severity = SeverityDescription,
      MachineDisplayName,
      MachineUuid
queryFrequency: 5m
description: Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.
id: 9a7c80ef-8dc2-4b07-834d-b9ca18d603f7
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.2
kind: Scheduled
customDetails:
  VbrHostName: DataSource
  MachineDisplayName: MachineDisplayName
  Severity: Severity
  EventId: EventId
  Date: Date
  MachineUuid: MachineUuid
  MessageDetails: MessageDetails
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Activity_Detected.yaml
relevantTechniques: []
tactics: []

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')]",
      "properties": {
        "alertRuleTemplateName": "9a7c80ef-8dc2-4b07-834d-b9ca18d603f7",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MachineDisplayName": "MachineDisplayName",
          "MachineUuid": "MachineUuid",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.",
        "displayName": "Malware Activity Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Activity_Detected.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 41600\n| extend ActivityType = extract(\"ActivityType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend MachineDisplayName = extract(\"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\\s*\\\\(([^)]+)\\\\)\", 1, Description)\n| extend MachineUuid = extract(\"([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\", 1, Description)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    UserName = user,\n    [\"Malware Detection Method\"] = ActivityType,\n    MessageDetails = Description,\n    Severity = SeverityDescription,\n    MachineDisplayName,\n    MachineUuid\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}