MS Graph message: Indicators that the system is infected with malware have been detected.

Description

field ms-graph.category="Malware"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 99500 MS Graph message: Microsoft graph messages grouped. anchor level 0
   decoded_as=json AND field integration="ms-graph"
2. 99501 MS Graph message: Alert related events. anchor level 3
   field ms-graph.relationship="alerts|alerts_v2"
3. 99503 MS Graph message: The alert/incident has not been resolved and is not a false positive. anchor level 6
   field ms-graph.status="resolved" AND field ms-graph.classification="falsePositive"
4. 99517 MS Graph message: Indicators associated with prevalent malware and common threats were detected. anchor level 6
   field ms-graph.severity="low"
5. 99591 MS Graph message: Indicators that the system is infected with malware have been detected. refinement level 15 this rule
   field ms-graph.category="Malware"

Rule dependencies

Depends on

• composes · Wazuh if_sid 99517
  • MS Graph message: Indicators associated with prevalent malware and common threats were detected.
• composes · Wazuh if_sid 99518
  • MS Graph message: Behaviors and indicators that might be a part of an advanced persistent threat (APT) were detected. This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth.
• composes · Wazuh if_sid 99519
  • MS Graph message: Behaviors and indicators that are commonly associated with advanced persistent threats (APT) activity were detected. There is a high risk of severe damage to affected assets. Requires immediate action.