Detection rules › Kusto
Acronis - Multiple Endpoints Infected by Ransomware
Detects when three or more distinct endpoints report ransomware detections within a single day.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rule body
id: a783ade7-bf43-416d-b809-8f5b06d87790
name: Acronis - Multiple Endpoints Infected by Ransomware
description: Detects when three or more distinct endpoints report ransomware detections within a single day.
severity: High
query: |
CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID == "ActiveProtectionBlocksSuspiciousActivity"
| summarize ActiveProtectionBlocksSuspiciousActivity = count() by DeviceName
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 2
tactics:
- Impact
relevantTechniques:
- T1486
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: true
lookbackDuration: P1D
matchingMethod: AnyAlert
eventGroupingSettings:
aggregationKind: SingleAlert
customDetails:
DeviceName: DeviceName
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DeviceName
version: 1.0.0
kind: Scheduled
requiredDataConnectors: []
Stages and Predicates
Stage 1: source
CommonSecurityLog
Stage 2: where
| where DeviceVendor == "Acronis"
Stage 3: where
| where DeviceEventClassID == "ActiveProtectionBlocksSuspiciousActivity"
Stage 4: summarize
| summarize ActiveProtectionBlocksSuspiciousActivity = count() by DeviceName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DeviceEventClassID | eq |
| field:"DeviceEventClassID" kind:eq value:"ActiveProtectionBlocksSuspiciousActivity" |
DeviceVendor | eq |
| field:"DeviceVendor" kind:eq value:"Acronis" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActiveProtectionBlocksSuspiciousActivity | summarize |
DeviceName | summarize |