Detection rules › Kusto

Acronis - Multiple Endpoints Infected by Ransomware

Severity
high
Time window
1d
Group by
DeviceName
Source
github.com/Azure/Azure-Sentinel

Detects when three or more distinct endpoints report ransomware detections within a single day.

MITRE ATT&CK coverage

TacticTechniques
Impact

Rule body

id: a783ade7-bf43-416d-b809-8f5b06d87790
name: Acronis - Multiple Endpoints Infected by Ransomware
description: Detects when three or more distinct endpoints report ransomware detections within a single day.
severity: High
query: |
    CommonSecurityLog
    | where DeviceVendor == "Acronis"
    | where DeviceEventClassID == "ActiveProtectionBlocksSuspiciousActivity"
    | summarize ActiveProtectionBlocksSuspiciousActivity = count() by DeviceName
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 2
tactics:
    - Impact
relevantTechniques:
    - T1486
incidentConfiguration:
    createIncident: true
    groupingConfiguration:
        enabled: true
        reopenClosedIncident: true
        lookbackDuration: P1D
        matchingMethod: AnyAlert
eventGroupingSettings:
    aggregationKind: SingleAlert
customDetails:
  DeviceName: DeviceName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
version: 1.0.0
kind: Scheduled
requiredDataConnectors: []

Stages and Predicates

Stage 1: source

CommonSecurityLog

Stage 2: where

| where DeviceVendor == "Acronis"

Stage 3: where

| where DeviceEventClassID == "ActiveProtectionBlocksSuspiciousActivity"

Stage 4: summarize

| summarize ActiveProtectionBlocksSuspiciousActivity = count() by DeviceName

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
ActiveProtectionBlocksSuspiciousActivitysummarize
DeviceNamesummarize