Ransomware hits healthcare - Clearing of system logs

Description

// Look for attempts to use fsutil.exe to delete file system logs that can be used as forensic artifacts.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "fsutil.exe"
and ProcessCommandLine has "usn" and ProcessCommandLine has "deletejournal"
Raw source Ransomware hits healthcare - Clearing of system logs · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 24216c89-0e83-4b53-8eb7-3349e52c3703
name: Ransomware hits healthcare - Clearing of system logs
description: |
  // Look for attempts to use fsutil.exe to delete file system logs that can be used as forensic artifacts.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName =~ "fsutil.exe"
  and ProcessCommandLine has "usn" and ProcessCommandLine has "deletejournal"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.