API - Account Takeover

Back


Id	25c86f99-0a91-4b7f-88f3-599a008e5ab8
Rulename	API - Account Takeover
Description	42Crunch API protection against account takeover
Severity	High
Tactics	CredentialAccess Discovery
Techniques	T1110 T1087
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAccountTakeover.yaml
Version	3.0.1
Arm template	25c86f99-0a91-4b7f-88f3-599a008e5ab8.json

KQL

let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where (UriPath has "/api/register" or UriPath has "/api/reset") and Status == 403;
let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
firstRec | take recCount

YAML

status: Available
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
query: |
  let firstRec = FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where (UriPath has "/api/register" or UriPath has "/api/reset") and Status == 403;
  let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
  firstRec | take recCount  
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAccountTakeover.yaml
tactics:
- CredentialAccess
- Discovery
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InstanceName
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
kind: Scheduled
relevantTechniques:
- T1110
- T1087
customDetails: 
description: |
    '42Crunch API protection against account takeover'
name: API - Account Takeover
version: 3.0.1
id: 25c86f99-0a91-4b7f-88f3-599a008e5ab8
severity: High

ARM