Malware Event Detected | Microsoft Sentinel Analytic Rules

Back


Id	b42424a6-10f4-447b-92a0-55ac38f4a475
Rulename	Malware Event Detected
Description	Detects when restore points are marked as infected. This might indicate potential compromise of backup data.
Severity	Medium
Required data connectors	VeeamCustomTablesDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Event_Detected.yaml
Version	1.0.1
Arm template	b42424a6-10f4-447b-92a0-55ac38f4a475.json

KQL

VeeamMalwareEvents_CL

YAML

name: Malware Event Detected
triggerOperator: gt
query: VeeamMalwareEvents_CL
queryFrequency: 5m
description: Detects when restore points are marked as infected. This might indicate potential compromise of backup data.
id: b42424a6-10f4-447b-92a0-55ac38f4a475
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.1
kind: Scheduled
customDetails:
  VbrHostName: VbrHostName
  MachineUuid: MachineUuid
  BackupObjectId: MachineBackupObjectId
  MachineDisplayName: MachineDisplayName
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamMalwareEvents_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Event_Detected.yaml
relevantTechniques: []
tactics: []
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: VbrHostName
  entityType: Host

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b42424a6-10f4-447b-92a0-55ac38f4a475')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b42424a6-10f4-447b-92a0-55ac38f4a475')]",
      "properties": {
        "alertRuleTemplateName": "b42424a6-10f4-447b-92a0-55ac38f4a475",
        "customDetails": {
          "BackupObjectId": "MachineBackupObjectId",
          "MachineDisplayName": "MachineDisplayName",
          "MachineUuid": "MachineUuid",
          "VbrHostName": "VbrHostName"
        },
        "description": "Detects when restore points are marked as infected. This might indicate potential compromise of backup data.",
        "displayName": "Malware Event Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "VbrHostName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/Malware_Event_Detected.yaml",
        "query": "VeeamMalwareEvents_CL",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}