File Backup Deletion Alerts

Description

This query checks alerts related to file backup deletion and enriches with additional alert evidence information

Query · kql

AlertInfo
| where Title == "File backups were deleted"
| join AlertEvidence on $left.AlertId == $right.AlertId
Raw source File Backup Deletion Alerts · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 21444f27-9184-45bf-a335-7b7169a56790
name: File Backup Deletion Alerts
description: |
  This query checks alerts related to file backup deletion and enriches with additional alert evidence information
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
tactics:
- Ransomware
query: |
  AlertInfo
  | where Title == "File backups were deleted"
  | join AlertEvidence on $left.AlertId == $right.AlertId

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.