API - Kiterunner detection

Back


Id	421b38ec-4295-4aed-8299-c92e268ad663
Rulename	API - Kiterunner detection
Description	42Crunch API protection against Kiterunner enumeration
Severity	Medium
Tactics	Reconnaissance Discovery
Techniques	T1595 T1580 T1083
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
Version	1.0.1
Arm template	421b38ec-4295-4aed-8299-c92e268ad663.json

KQL

let discoveryRecords = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
| where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp_t desc

YAML

queryFrequency: 5m
name: API - Kiterunner detection
entityMappings:
- fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName
  entityType: Account
tactics:
- Reconnaissance
- Discovery
customDetails: 
id: 421b38ec-4295-4aed-8299-c92e268ad663
queryPeriod: 5m
relevantTechniques:
- T1595
- T1580
- T1083
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
triggerOperator: gt
triggerThreshold: 0
version: 1.0.1
requiredDataConnectors:
- dataTypes:
  - apifirewall_log_1_CL
  connectorId: 42CrunchAPIProtection
query: |
  let discoveryRecords = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
  | where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
  let discoveryCnt = (toscalar(discoveryRecords | count));
  let recCount = iff((discoveryCnt > 500), 1, 0);
  discoveryRecords | top recCount by Timestamp_t desc  
status: Available
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: Medium
kind: Scheduled
description: |
    '42Crunch API protection against Kiterunner enumeration'

ARM