Correlation Rule High
✕

Microsoft Defender for Endpoint - Malware Detected

This alert will trigger when Malware is detected by Microsoft Defender for Endpoint.

Module:
Enterprise Runtime Security, Cortex Cloud
Licensed by:
Enterprise Runtime Security (ADV-EP)
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Microsoft Defender Advanced Threat Protection, microsoft_365_defender_raw
Category:
Execution
Content pack:
Microsoft Defender for Endpoint
Execution:
SCHEDULED
Search window:
10 minutes
XQL query: 
datamodel dataset = microsoft_365_defender_raw 
|filter (xdm.alert.category = "Malware") and xdm.target.file.sha256 != null
|fields 
    xdm.event.id,
    xdm.alert.original_alert_id,
    xdm.alert.severity,
    xdm.alert.subcategory,
    xdm.alert.name,
    xdm.alert.description,
    xdm.target.host.device_id,
    xdm.target.host.fqdn,
    xdm.alert.mitre_techniques,
    xdm.target.file.sha256,
    xdm.target.file.filename,
    xdm.target.file.path,
    xdm.target.process.pid,
    xdm.target.process.command_line,
    xdm.target.process.parent_id,
    xdm.target.host.ipv4_addresses,
    xdm.target.registry.key,
    xdm.target.registry.value_type,
    xdm.target.registry.value,
    xdm.source.user.username,
    xdm.source.user.domain,
    xdm.source.user.identifier,
    xdm.target.ipv4,
    xdm.event.outcome

Open the full correlation rule →