API - Account Takeover

Back


Id	25c86f99-0a91-4b7f-88f3-599a008e5ab8
Rulename	API - Account Takeover
Description	42Crunch API protection against account takeover
Severity	High
Tactics	CredentialAccess Discovery
Techniques	T1110 T1087
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAccountTakeover.yaml
Version	1.0.0
Arm template	25c86f99-0a91-4b7f-88f3-599a008e5ab8.json

KQL

let firstRec = apifirewall_log_1_CL 
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
| where Instance_Name_s == "Instance_1" and (URI_Path_s has "/api/register" or URI_Path_s has "/api/reset") and Status_d == 403;
let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
firstRec | take recCount

YAML

requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - apifirewall_log_1_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAccountTakeover.yaml
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1110
- T1087
queryPeriod: 5m
name: API - Account Takeover
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
- entityType: Account
  fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName
status: Available
customDetails: 
queryFrequency: 5m
triggerOperator: gt
kind: Scheduled
description: |
    '42Crunch API protection against account takeover'
tactics:
- CredentialAccess
- Discovery
severity: High
version: 1.0.0
query: |
  let firstRec = apifirewall_log_1_CL 
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
  | where Instance_Name_s == "Instance_1" and (URI_Path_s has "/api/register" or URI_Path_s has "/api/reset") and Status_d == 403;
  let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
  firstRec | take recCount  
id: 25c86f99-0a91-4b7f-88f3-599a008e5ab8

ARM