Detection rules › Kusto

Malware Detection Exclusions List Updated

Status
available
Severity
medium
Time window
5m
Source
github.com/Azure/Azure-Sentinel

Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.

Rule body

id: 401e91cb-b53f-41a5-b066-1c028b3b51db
name: Malware Detection Exclusions List Updated
description: Detects when malware detection exclusions are updated. This might indicate
  potential compromise of backup data.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 42280\n| project\n  Date =\
  \ format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n\
  \    EventId = instanceId,\n    UserName = user,\n   MessageDetails = Description,\n\
  \   Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

Stages and Predicates

Stage 1: source

Veeam_GetSecurityEvents

Stage 2: where

| where instanceId == 42280

Stage 3: project

| project
  Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
   MessageDetails = Description,
   Severity = SeverityDescription

Stage 4: project

| project Date, DataSource, EventId, UserName,MessageDetails,Severity

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
DataSourceproject
Dateproject
EventIdproject
MessageDetailsproject
Severityproject
UserNameproject