Securityalert Antimalware Action
KQL detection rule by ep3p · MIT
No description provided
SecurityAlert
| where AlertName has "Antimalware Action" and ProviderName == "Azure Security Center"
| summarize arg_min(TimeGenerated, *) by SystemAlertId
| where not(Status == "Dismissed")
| extend ExtendedProperties = todynamic(ExtendedProperties)
| extend
ActionTaken = tostring(ExtendedProperties["ActionTaken"]),
Category = tostring(ExtendedProperties["Category"]),
FilePath = split(ExtendedProperties["File Path"], ", "),
ProtectionType = tostring(ExtendedProperties["Protection Type"]),
ThreatID = tostring(ExtendedProperties["Threat ID"]),
ThreatStatus = tostring(ExtendedProperties["Threat Status"]),
ThreatName = tostring(ExtendedProperties["ThreatName"])
| mv-expand FilePath to typeof(string)
// Clean Entities
| extend Entities = replace_regex(Entities, @'(\,\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}|\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}\,|\,\{\"\$ref\"\:\"\d+\"\})|\"\$id\"\:\"\d+\"\,', '')
| summarize
TimeGenerated = min(TimeGenerated),
StartTime = min(StartTime),
EndTime = max(EndTime),
Categories = array_sort_asc(make_set(Category)),
Threats = make_set(bag_pack("ThreatName", ThreatName, "FilePath", FilePath, "ThreatID", ThreatID)),
AlertLinks = make_set(AlertLink, 250),
Entities = make_set(todynamic(Entities)),
take_any(RemediationSteps, Tactics, Techniques)
by AlertName, AlertSeverity, Description, ResourceId = tolower(ResourceId), CompromisedEntity, ProtectionType, ActionTaken, ThreatStatus
| project
TimeGenerated,
AlertName,
AlertSeverity,
Description,
RemediationSteps,
ResourceId,
StartTime,
EndTime,
CompromisedEntity,
ProtectionType,
ActionTaken,
ThreatStatus,
Categories,
Threats,
AlertLinks,
Tactics,
Techniques,
Entities