API - Kiterunner detection

Back


Id	421b38ec-4295-4aed-8299-c92e268ad663
Rulename	API - Kiterunner detection
Description	42Crunch API protection against Kiterunner enumeration
Severity	Medium
Tactics	Reconnaissance Discovery
Techniques	T1595 T1580 T1083
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
Version	1.0.1
Arm template	421b38ec-4295-4aed-8299-c92e268ad663.json

KQL

let discoveryRecords = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
| where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp_t desc

YAML

description: |
    '42Crunch API protection against Kiterunner enumeration'
kind: Scheduled
tactics:
- Reconnaissance
- Discovery
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - apifirewall_log_1_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
severity: Medium
name: API - Kiterunner detection
customDetails: 
triggerThreshold: 0
queryPeriod: 5m
query: |
  let discoveryRecords = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
  | where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
  let discoveryCnt = (toscalar(discoveryRecords | count));
  let recCount = iff((discoveryCnt > 500), 1, 0);
  discoveryRecords | top recCount by Timestamp_t desc  
relevantTechniques:
- T1595
- T1580
- T1083
id: 421b38ec-4295-4aed-8299-c92e268ad663
queryFrequency: 5m
status: Available
version: 1.0.1
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
- entityType: Account
  fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName

ARM