MS Graph message: Indicators that the system is potentially experiencing intrusion attempts have been detected. This alert is commonly caused by phishing emails. Check the system for signs of infection.

Description

MS Graph message: Indicators that the system is potentially experiencing intrusion attempts have been detected. This alert is commonly caused by phishing emails. Check the system for signs of infection.

Query · wazuh

field ms-graph.category="InitialAccess"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 99500 MS Graph message: Microsoft graph messages grouped. anchor level 0
    decoded_as=json AND field integration="ms-graph"
  2. 99501 MS Graph message: Alert related events. anchor level 3
    field ms-graph.relationship="alerts|alerts_v2"
  3. 99503 MS Graph message: The alert/incident has not been resolved and is not a false positive. anchor level 6
    field ms-graph.status="resolved" AND field ms-graph.classification="falsePositive"
  4. 99516 MS Graph message: Indicators suggesting potential security issues were detected, but they might not be actionable or harmful. anchor level 6
    field ms-graph.severity="informational"
  5. 99530 MS Graph message: Indicators that the system is potentially experiencing intrusion attempts have been detected. This alert is commonly caused by phishing emails. Check the system for signs of infection. refinement level 3 this rule
    field ms-graph.category="InitialAccess"

Rule dependencies

Depends on

Raw source MS Graph message: Indicators that the system is potentially experiencing intrusion attempts have been detected. This alert is commonly caused by phishing emails. Check the system for signs of infection. · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="99530" level="3">
        <if_sid>99516</if_sid>
        <options>no_full_log</options>
        <field name="ms-graph.category">InitialAccess</field>
        <mitre>
            <id>TA0001</id>
        </mitre>
        <description>MS Graph message: Indicators that the system is potentially experiencing intrusion attempts have been detected. This alert is commonly caused by phishing emails. Check the system for signs of infection.</description>
    </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.