Ransomware hits healthcare - Backup deletion

Description

List alerts flagging attempts to delete backup files.

Query · kql

AlertInfo
| where Timestamp > ago(7d) 
| where Title == "File backups were deleted" 
| join AlertEvidence on AlertId
Raw source Ransomware hits healthcare - Backup deletion · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b0188e2d-734d-4d54-8e70-c4157a195bb1
name: Ransomware hits healthcare - Backup deletion
description: |
  List alerts flagging attempts to delete backup files.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
query: |
  AlertInfo
  | where Timestamp > ago(7d) 
  | where Title == "File backups were deleted" 
  | join AlertEvidence on AlertId

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.