Apache - Command in URI

Back


Id	54da6a42-3b00-11ec-8d3d-0242ac130003
Rulename	Apache - Command in URI
Description	Detects command in URI
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheCommandInURI.yaml
Version	1.0.3
Arm template	54da6a42-3b00-11ec-8d3d-0242ac130003.json

KQL

let cmd_list = dynamic(['whoami', 'dpkg', 'useradd', 'sudo', 'cat']);
ApacheHTTPServer
| where UrlOriginal has_any (cmd_list)
| extend UrlCustomEntity = UrlOriginal

YAML

description: |
    'Detects command in URI'
version: 1.0.3
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 15m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheCommandInURI.yaml
triggerOperator: gt
status: Available
id: 54da6a42-3b00-11ec-8d3d-0242ac130003
name: Apache - Command in URI
queryFrequency: 15m
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
relevantTechniques:
- T1190
- T1133
query: |
  let cmd_list = dynamic(['whoami', 'dpkg', 'useradd', 'sudo', 'cat']);
  ApacheHTTPServer
  | where UrlOriginal has_any (cmd_list)
  | extend UrlCustomEntity = UrlOriginal  
requiredDataConnectors:
- datatypes:
  - ApacheHTTPServer_CL
  connectorId: CustomLogsAma

ARM