ApexOne - Commands in Url

Back


Id	4a9a5900-67b7-11ec-90d6-0242ac120003
Rulename	ApexOne - Commands in Url
Description	Detects commands in Url.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml
Version	1.0.3
Arm template	4a9a5900-67b7-11ec-90d6-0242ac120003.json

KQL

TMApexOneEvent
| where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106") 
| where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' 
| extend UrlCustomEntity = UrlOriginal

YAML

relevantTechniques:
- T1190
- T1133
name: ApexOne - Commands in Url
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: UrlCustomEntity
  entityType: URL
triggerThreshold: 0
id: 4a9a5900-67b7-11ec-90d6-0242ac120003
tactics:
- InitialAccess
version: 1.0.3
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: High
status: Available
description: |
    'Detects commands in Url.'
query: |
  TMApexOneEvent
  | where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106") 
  | where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' 
  | extend UrlCustomEntity = UrlOriginal  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4a9a5900-67b7-11ec-90d6-0242ac120003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4a9a5900-67b7-11ec-90d6-0242ac120003')]",
      "properties": {
        "alertRuleTemplateName": "4a9a5900-67b7-11ec-90d6-0242ac120003",
        "customDetails": null,
        "description": "'Detects commands in Url.'\n",
        "displayName": "ApexOne - Commands in Url",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "UrlCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml",
        "query": "TMApexOneEvent\n| where EventSubType in (\"WB:7\", \"CnC:Block\", \"VAD\", \"700106\") \n| where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' \n| extend UrlCustomEntity = UrlOriginal\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}