AppServices AV Scan with Infected Files

Back


Id	9d0295ee-cb75-4f2c-9952-e5acfbb67036
Rulename	AppServices AV Scan with Infected Files
Description	Identifies if an AV scan finds infected files in Azure App Services.
Severity	Informational
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	1
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureAppServices/AVScan_Infected_Files_Found.yaml
Version	1.0.3
Arm template	9d0295ee-cb75-4f2c-9952-e5acfbb67036.json

KQL

let timeframe = ago(1d);
AppServiceAntivirusScanAuditLogs
| where NumberOfInfectedFiles > 0
| extend timestamp = TimeGenerated

YAML

queryPeriod: 1d
description: |
    'Identifies if an AV scan finds infected files in Azure App Services.'
triggerThreshold: 1
id: 9d0295ee-cb75-4f2c-9952-e5acfbb67036
queryFrequency: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureAppServices/AVScan_Infected_Files_Found.yaml
kind: Scheduled
requiredDataConnectors: []
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: _ResourceId
    identifier: AzureID
  entityType: Host
name: AppServices AV Scan with Infected Files
version: 1.0.3
severity: Informational
query: |
  let timeframe = ago(1d);
  AppServiceAntivirusScanAuditLogs
  | where NumberOfInfectedFiles > 0
  | extend timestamp = TimeGenerated  
metadata:
  support:
    tier: Community
  source:
    kind: Community
  author:
    name: SecurityJedi
  categories:
    domains:
    - Security - Others
    - Platform

ARM