backup-deletion

Description

This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques. The following query returns alerts raised when backup files were deleted. The See also section below lists more queries related to techniques shared by these campaigns. Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/

Query · kql

AlertInfo
| where Timestamp > ago(7d) 
| where Title == "File backups were deleted"
Raw source backup-deletion · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1df2054c-5c63-4a2c-943b-0069af45bd38
name: backup-deletion
description: |
  This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
  In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
  The following query returns alerts raised when backup files were deleted.
  The See also section below lists more queries related to techniques shared by these campaigns.
  Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
tactics:
- Defense evasion
- Impact
query: |
  AlertInfo
  | where Timestamp > ago(7d) 
  | where Title == "File backups were deleted"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.