Apache - Requests to rare files

Back


Id	14d7e15e-3afb-11ec-8d3d-0242ac130003
Rulename	Apache - Requests to rare files
Description	Shows requests to rare files
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	ApacheHTTPServer CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestToRareFile.yaml
Version	1.0.1
Arm template	14d7e15e-3afb-11ec-8d3d-0242ac130003.json

KQL

let lb_period_start = 14d;
let lb_period_end = 1d;
let known_files = ApacheHTTPServer
| where TimeGenerated between (ago(lb_period_start) .. ago(lb_period_end))
| extend File = extract(@"(.*\/)?(.*)", 2, tostring(UrlOriginal))
| summarize makeset(File);
ApacheHTTPServer
| where TimeGenerated > ago(24h)
| extend File = extract(@"(.*\/)?(.*)", 2, tostring(UrlOriginal))
| where File in~ (known_files)
| extend FileCustomEntity = File, UrlCustomEntity = UrlOriginal

YAML

relevantTechniques:
- T1190
- T1133
name: Apache - Requests to rare files
requiredDataConnectors:
- dataTypes:
  - ApacheHTTPServer
  connectorId: ApacheHTTPServer
- datatypes:
  - ApacheHTTPServer_CL
  connectorId: CustomLogsAma
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: FileCustomEntity
  entityType: File
- fieldMappings:
  - identifier: Url
    columnName: UrlCustomEntity
  entityType: URL
triggerThreshold: 0
id: 14d7e15e-3afb-11ec-8d3d-0242ac130003
tactics:
- InitialAccess
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestToRareFile.yaml
queryPeriod: 14d
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Shows requests to rare files'
query: |
  let lb_period_start = 14d;
  let lb_period_end = 1d;
  let known_files = ApacheHTTPServer
  | where TimeGenerated between (ago(lb_period_start) .. ago(lb_period_end))
  | extend File = extract(@"(.*\/)?(.*)", 2, tostring(UrlOriginal))
  | summarize makeset(File);
  ApacheHTTPServer
  | where TimeGenerated > ago(24h)
  | extend File = extract(@"(.*\/)?(.*)", 2, tostring(UrlOriginal))
  | where File in~ (known_files)
  | extend FileCustomEntity = File, UrlCustomEntity = UrlOriginal  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/14d7e15e-3afb-11ec-8d3d-0242ac130003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/14d7e15e-3afb-11ec-8d3d-0242ac130003')]",
      "properties": {
        "alertRuleTemplateName": "14d7e15e-3afb-11ec-8d3d-0242ac130003",
        "customDetails": null,
        "description": "'Shows requests to rare files'\n",
        "displayName": "Apache - Requests to rare files",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "columnName": "FileCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "UrlCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestToRareFile.yaml",
        "query": "let lb_period_start = 14d;\nlet lb_period_end = 1d;\nlet known_files = ApacheHTTPServer\n| where TimeGenerated between (ago(lb_period_start) .. ago(lb_period_end))\n| extend File = extract(@\"(.*\\/)?(.*)\", 2, tostring(UrlOriginal))\n| summarize makeset(File);\nApacheHTTPServer\n| where TimeGenerated > ago(24h)\n| extend File = extract(@\"(.*\\/)?(.*)\", 2, tostring(UrlOriginal))\n| where File in~ (known_files)\n| extend FileCustomEntity = File, UrlCustomEntity = UrlOriginal\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}