Malware Event Detected

Back


Id	b42424a6-10f4-447b-92a0-55ac38f4a475
Rulename	Malware Event Detected
Description	Detects when restore points are marked as infected. This might indicate potential compromise of backup data.
Severity	Medium
Required data connectors	VeeamCustomTablesDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Malware_Event_Detected.yaml
Version	1.0.1
Arm template	b42424a6-10f4-447b-92a0-55ac38f4a475.json

KQL

VeeamMalwareEvents_CL

YAML

name: Malware Event Detected
id: b42424a6-10f4-447b-92a0-55ac38f4a475
description: Detects when restore points are marked as infected. This might indicate potential compromise of backup data.
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: VbrHostName
    identifier: HostName
  entityType: Host
version: 1.0.1
triggerOperator: gt
query: VeeamMalwareEvents_CL
tactics: []
kind: Scheduled
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Malware_Event_Detected.yaml
severity: Medium
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - VeeamMalwareEvents_CL
  connectorId: VeeamCustomTablesDataConnector
status: Available
customDetails:
  MachineDisplayName: MachineDisplayName
  VbrHostName: VbrHostName
  BackupObjectId: MachineBackupObjectId
  MachineUuid: MachineUuid
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []

ARM