MS Graph message: Indicators that the system is performing defense evasion have been detected. This alert usually originates from common malware and threats, rather than APT activity. Check the system for signs of infection.

Description

MS Graph message: Indicators that the system is performing defense evasion have been detected. This alert usually originates from common malware and threats, rather than APT activity. Check the system for signs of infection.

Query · wazuh

field ms-graph.category="DefenseEvasion"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 99500 MS Graph message: Microsoft graph messages grouped. anchor level 0
    decoded_as=json AND field integration="ms-graph"
  2. 99501 MS Graph message: Alert related events. anchor level 3
    field ms-graph.relationship="alerts|alerts_v2"
  3. 99503 MS Graph message: The alert/incident has not been resolved and is not a false positive. anchor level 6
    field ms-graph.status="resolved" AND field ms-graph.classification="falsePositive"
  4. 99512 MS Graph message: Unknown severity. anchor level 6
    field ms-graph.severity="unknown"
  5. 99546 MS Graph message: Indicators that the system is performing defense evasion have been detected. This alert usually originates from common malware and threats, rather than APT activity. Check the system for signs of infection. refinement level 12 this rule
    field ms-graph.category="DefenseEvasion"

Rule dependencies

Depends on

Raw source MS Graph message: Indicators that the system is performing defense evasion have been detected. This alert usually originates from common malware and threats, rather than APT activity. Check the system for signs of infection. · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="99546" level="12">
        <if_sid>99512,99517</if_sid>
        <options>no_full_log</options>
        <field name="ms-graph.category">DefenseEvasion</field>
        <mitre>
            <id>TA0005</id>
        </mitre>
        <description>MS Graph message: Indicators that the system is performing defense evasion have been detected. This alert usually originates from common malware and threats, rather than APT activity. Check the system for signs of infection.</description>
    </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.