API - Kiterunner detection

Back


Id	421b38ec-4295-4aed-8299-c92e268ad663
Rulename	API - Kiterunner detection
Description	42Crunch API protection against Kiterunner enumeration
Severity	Medium
Tactics	Reconnaissance Discovery
Techniques	T1595 T1580 T1083
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
Version	1.0.1
Arm template	421b38ec-4295-4aed-8299-c92e268ad663.json

KQL

let discoveryRecords = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
| where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp_t desc

YAML

name: API - Kiterunner detection
relevantTechniques:
- T1595
- T1580
- T1083
id: 421b38ec-4295-4aed-8299-c92e268ad663
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
requiredDataConnectors:
- dataTypes:
  - apifirewall_log_1_CL
  connectorId: 42CrunchAPIProtection
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.1
severity: Medium
triggerThreshold: 0
queryPeriod: 5m
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: Source_IP_s
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Hostname_s
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Instance_Name_s
  entityType: Account
kind: Scheduled
queryFrequency: 5m
status: Available
query: |
  let discoveryRecords = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
  | where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
  let discoveryCnt = (toscalar(discoveryRecords | count));
  let recCount = iff((discoveryCnt > 500), 1, 0);
  discoveryRecords | top recCount by Timestamp_t desc  
tactics:
- Reconnaissance
- Discovery
customDetails: 
description: |
    '42Crunch API protection against Kiterunner enumeration'
triggerOperator: gt

ARM