MS Graph message: Suspicious activity has been detected. This can range from log clearing to hack-tools being used. This alert may be indicative of an APT.

Description

field ms-graph.category="SuspiciousActivity"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 99500 MS Graph message: Microsoft graph messages grouped. anchor level 0
   decoded_as=json AND field integration="ms-graph"
2. 99501 MS Graph message: Alert related events. anchor level 3
   field ms-graph.relationship="alerts|alerts_v2"
3. 99503 MS Graph message: The alert/incident has not been resolved and is not a false positive. anchor level 6
   field ms-graph.status="resolved" AND field ms-graph.classification="falsePositive"
4. 99518 MS Graph message: Behaviors and indicators that might be a part of an advanced persistent threat (APT) were detected. This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. anchor level 12
   field ms-graph.severity="medium"
5. 99574 MS Graph message: Suspicious activity has been detected. This can range from log clearing to hack-tools being used. This alert may be indicative of an APT. refinement level 13 this rule
   field ms-graph.category="SuspiciousActivity"

Rule dependencies

Depends on

• composes · Wazuh if_sid 99518
  • MS Graph message: Behaviors and indicators that might be a part of an advanced persistent threat (APT) were detected. This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth.