IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Microsoft 365 Potential ransomware activity
editMicrosoft 365 Potential ransomware activity
editIdentifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware.
Rule type: query
Rule indices:
- filebeat-*
- logs-o365*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-30m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Cloud
- Microsoft 365
- Continuous Monitoring
- SecOps
- Configuration Audit
Version: 100 (version history)
Added (Elastic Stack release): 7.16.0
Last modified (Elastic Stack release): 8.5.0
Rule authors: Austin Songer
Rule license: Elastic License v2
Potential false positives
editIf Cloud App Security identifies, for example, a high rate of file uploads or file deletion activities it may represent an adverse encryption process.
Investigation guide
editRule query
editevent.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Potential ransomware activity" and event.outcome:success
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
-
Technique:
- Name: Data Encrypted for Impact
- ID: T1486
- Reference URL: https://attack.mitre.org/techniques/T1486/
Rule version history
edit- Version 100 (8.5.0 release)
-
- Formatting only
- Version 5 (8.4.0 release)
-
- Formatting only
- Version 3 (8.1.0 release)
-
- Formatting only
- Version 2 (8.0.0 release)
-
- Formatting only