Microsoft Defender for Endpoint - Malware Detected

This alert will trigger when Malware is detected by Microsoft Defender for Endpoint.

Microsoft Defender for Endpoint HIGH EXECUTION

Details

ID6af7a4d0-498c-4d89-804c-655dd14c37ab
From Version6.10.0
Execution ModeSCHEDULED
Crontab*/10 * * * *
Search Window10 minutes
Datasetalerts

XQL Query

datamodel dataset = microsoft_365_defender_raw 
|filter (xdm.alert.category = "Malware") and xdm.target.file.sha256 != null
|fields 
    xdm.event.id,
    xdm.alert.original_alert_id,
    xdm.alert.severity,
    xdm.alert.subcategory,
    xdm.alert.name,
    xdm.alert.description,
    xdm.target.host.device_id,
    xdm.target.host.fqdn,
    xdm.alert.mitre_techniques,
    xdm.target.file.sha256,
    xdm.target.file.filename,
    xdm.target.file.path,
    xdm.target.process.pid,
    xdm.target.process.command_line,
    xdm.target.process.parent_id,
    xdm.target.host.ipv4_addresses,
    xdm.target.registry.key,
    xdm.target.registry.value_type,
    xdm.target.registry.value,
    xdm.source.user.username,
    xdm.source.user.domain,
    xdm.source.user.identifier,
    xdm.target.ipv4,
    xdm.event.outcome

Source

MicrosoftDefenderAdvancedThreatProtection_correlation-rule.yml
Download History Raw 
alert_category: EXECUTION
alert_description: This alert will trigger when Malware is detected by Microsoft Defender for Endpoint.
alert_fields:
  action_local_ip: xdm.target.ipv4
  actor_effective_username: xdm.source.user.username
  actor_process_command_line: xdm.target.process.command_line
  actor_process_image_path: xdm.target.file.path
  actor_process_image_sha256: xdm.target.file.sha256
  agent_device_domain: xdm.source.user.domain
  agent_hostname: xdm.target.host.fqdn
  eventid: xdm.event.id
alert_name: Malware detected by Microsoft Defender for Endpoints
crontab: '*/10 * * * *'
dataset: alerts
description: This alert will trigger when Malware is detected by Microsoft Defender for Endpoint.
drilldown_query_timeframe: ALERT
execution_mode: SCHEDULED
global_rule_id: 6af7a4d0-498c-4d89-804c-655dd14c37ab
investigation_query_link: ''
mapping_strategy: CUSTOM
mitre_defs: {}
name: Microsoft Defender for Endpoint - Malware Detected
search_window: 10 minutes
severity: SEV_040_HIGH
suppression_duration:
suppression_enabled: false
suppression_fields:
user_defined_category:
user_defined_severity:
xql_query: "datamodel dataset = microsoft_365_defender_raw \r\n|filter (xdm.alert.category = \"Malware\") and xdm.target.file.sha256 != null\r\n|fields \r\n    xdm.event.id,\r\n    xdm.alert.original_alert_id,\r\n    xdm.alert.severity,\r\n    xdm.alert.subcategory,\r\n    xdm.alert.name,\r\n    xdm.alert.description,\r\n    xdm.target.host.device_id,\r\n    xdm.target.host.fqdn,\r\n    xdm.alert.mitre_techniques,\r\n    xdm.target.file.sha256,\r\n    xdm.target.file.filename,\r\n    xdm.target.file.path,\r\n    xdm.target.process.pid,\r\n    xdm.target.process.command_line,\r\n    xdm.target.process.parent_id,\r\n    xdm.target.host.ipv4_addresses,\r\n    xdm.target.registry.key,\r\n    xdm.target.registry.value_type,\r\n    xdm.target.registry.value,\r\n    xdm.source.user.username,\r\n    xdm.source.user.domain,\r\n    xdm.source.user.identifier,\r\n    xdm.target.ipv4,\r\n    xdm.event.outcome"
fromversion: 6.10.0
supportedModules: ["agentix", "xsiam"]