Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tomcat - Put file and get file from same IP address

Back
Id103d5ada-4874-11ec-81d3-0242ac130003
RulenameTomcat - Put file and get file from same IP address
DescriptionDetects put or get files from one source in short timeframe'
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml
Version1.0.2
Arm template103d5ada-4874-11ec-81d3-0242ac130003.json
Deploy To Azure
let p = TomcatEvent
| where HttpRequestMethod in~ ('POST', 'PUT')
| sort by EventStartTime asc
| summarize post_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal);
TomcatEvent
| where HttpRequestMethod =~ 'GET'
| sort by EventStartTime asc
| summarize get_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal)
| join kind=innerunique (p) on UrlOriginal, SrcIpAddr
| extend second = datetime_diff('second',get_time,post_time)
| where second between (1 .. 300)
| project second, post_time, get_time, SrcIpAddr, UrlOriginal
| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = tostring(UrlOriginal)
description: |
    'Detects put or get files from one source in short timeframe' 
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml
severity: Medium
status: Available
kind: Scheduled
relevantTechniques:
- T1190
- T1133
tactics:
- InitialAccess
queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
triggerThreshold: 0
queryPeriod: 1h
triggerOperator: gt
version: 1.0.2
id: 103d5ada-4874-11ec-81d3-0242ac130003
name: Tomcat - Put file and get file from same IP address
query: |
  let p = TomcatEvent
  | where HttpRequestMethod in~ ('POST', 'PUT')
  | sort by EventStartTime asc
  | summarize post_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal);
  TomcatEvent
  | where HttpRequestMethod =~ 'GET'
  | sort by EventStartTime asc
  | summarize get_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal)
  | join kind=innerunique (p) on UrlOriginal, SrcIpAddr
  | extend second = datetime_diff('second',get_time,post_time)
  | where second between (1 .. 300)
  | project second, post_time, get_time, SrcIpAddr, UrlOriginal
  | extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = tostring(UrlOriginal)  
requiredDataConnectors:
- datatypes:
  - Tomcat_CL
  connectorId: CustomLogsAma
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/103d5ada-4874-11ec-81d3-0242ac130003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/103d5ada-4874-11ec-81d3-0242ac130003')]",
      "properties": {
        "alertRuleTemplateName": "103d5ada-4874-11ec-81d3-0242ac130003",
        "customDetails": null,
        "description": "'Detects put or get files from one source in short timeframe' \n",
        "displayName": "Tomcat - Put file and get file from same IP address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "UrlCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml",
        "query": "let p = TomcatEvent\n| where HttpRequestMethod in~ ('POST', 'PUT')\n| sort by EventStartTime asc\n| summarize post_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal);\nTomcatEvent\n| where HttpRequestMethod =~ 'GET'\n| sort by EventStartTime asc\n| summarize get_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal)\n| join kind=innerunique (p) on UrlOriginal, SrcIpAddr\n| extend second = datetime_diff('second',get_time,post_time)\n| where second between (1 .. 300)\n| project second, post_time, get_time, SrcIpAddr, UrlOriginal\n| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = tostring(UrlOriginal)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}