API - Kiterunner detection

Back


Id	421b38ec-4295-4aed-8299-c92e268ad663
Rulename	API - Kiterunner detection
Description	42Crunch API protection against Kiterunner enumeration
Severity	Medium
Tactics	Reconnaissance Discovery
Techniques	T1595 T1580 T1083
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
Version	1.0.1
Arm template	421b38ec-4295-4aed-8299-c92e268ad663.json

KQL

let discoveryRecords = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
| where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp_t desc

YAML

id: 421b38ec-4295-4aed-8299-c92e268ad663
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: Source_IP_s
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Hostname_s
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Instance_Name_s
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - apifirewall_log_1_CL
  connectorId: 42CrunchAPIProtection
triggerOperator: gt
queryFrequency: 5m
queryPeriod: 5m
status: Available
query: |
  let discoveryRecords = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g 
  | where Status_d == 404 and Error_Message_s startswith "path not defined in OAS";
  let discoveryCnt = (toscalar(discoveryRecords | count));
  let recCount = iff((discoveryCnt > 500), 1, 0);
  discoveryRecords | top recCount by Timestamp_t desc  
name: API - Kiterunner detection
kind: Scheduled
tactics:
- Reconnaissance
- Discovery
severity: Medium
relevantTechniques:
- T1595
- T1580
- T1083
triggerThreshold: 0
version: 1.0.1
description: |
    '42Crunch API protection against Kiterunner enumeration'
customDetails:

ARM