ApexOne - Commands in Url

Back


Id	4a9a5900-67b7-11ec-90d6-0242ac120003
Rulename	ApexOne - Commands in Url
Description	Detects commands in Url.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml
Version	1.0.3
Arm template	4a9a5900-67b7-11ec-90d6-0242ac120003.json

KQL

TMApexOneEvent
| where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106") 
| where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' 
| extend UrlCustomEntity = UrlOriginal

YAML

queryPeriod: 1h
query: |
  TMApexOneEvent
  | where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106") 
  | where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' 
  | extend UrlCustomEntity = UrlOriginal  
name: ApexOne - Commands in Url
entityMappings:
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
description: |
    'Detects commands in Url.'
kind: Scheduled
version: 1.0.3
status: Available
severity: High
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: 4a9a5900-67b7-11ec-90d6-0242ac120003

ARM