Kaseya VSA REvil Ransomware Attack Audit

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tsysOS.OSname As OS,
Service.[Service Name],
Service.[Service Path],
Service.[Service Start Mode],
Service.[Service State],
DB.displayVersion As [SQL Version],
DB.skuName As [SQL Edition],
DB.name As [DB name],
DB.dataFilesSizeKb As [DB Size],
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblState On tblState.State = tblAssetCustom.State
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Left Join (Select tblServices.AssetID,
tblServicesUni.Caption As [Service Name],
tblServicesUni.Pathname As [Service Path],
tblServiceStartMode.StartMode As [Service Start Mode],
tblServiceState.State As [Service State]
From tblServices
Inner Join tblServicesUni On tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Inner Join tblServiceStartMode On tblServiceStartMode.StartID =
tblServices.StartID
Inner Join tblServiceState On tblServiceState.StateID =
tblServices.StateID
Where tblServicesUni.Caption Like '%Kaseya%') As Service On
Service.AssetID = tblAssets.AssetID
Left Join (Select tblSqlServers.AssetID,
tblSqlServers.displayVersion,
tblSqlServers.skuName,
tblSqlDatabases.name,
tblSqlDatabases.dataFilesSizeKb
From tblSqlServers
Inner Join tblSqlDatabases On tblSqlDatabases.sqlServerId =
tblSqlServers.sqlServerId
Where tblSqlDatabases.name = 'ksubscribers') As DB On DB.AssetID =
tblAssets.AssetID
Where (Service.[Service Name] Is Not Null Or DB.name Is Not Null) And
tblState.Statename = 'Active'
Order By tblAssets.Domain,
tblAssets.AssetName