↳ GitHub sourceAnalytics ruleHigh

Malware Activity Detected

View on GitHub ↗Original file ↗

Description

Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.

Rule type: Scheduled
Version: 1.0.2
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Syslog SyslogAma

Data types

Syslog

KQL query

Original query, unchanged.

Veeam_GetSecurityEvents
| where instanceId == 41600
| extend ActivityType = extract("ActivityType=\"([^\"]*)\"", 1, SyslogMessage)
| extend MachineDisplayName = extract("[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\s*\\(([^)]+)\\)", 1, Description)
| extend MachineUuid = extract("([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})", 1, Description)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
    ["Malware Detection Method"] = ActivityType,
    MessageDetails = Description,
    Severity = SeverityDescription,
    MachineDisplayName,
    MachineUuid

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Veeam/Analytic Rules/Malware_Activity_Detected.yaml ↗
Commit: 9800e51 ↗
Source identifier: 9a7c80ef-8dc2-4b07-834d-b9ca18d603f7

Additional source files 1

Solutions/Veeam/Analytic Rules/Malware_Activity_Detected.yamlsource ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.