Cloudflare - Unexpected POST requests

Back


Id	7313352a-09f6-4a84-88bd-6f17f1cbeb88
Rulename	Cloudflare - Unexpected POST requests
Description	Detects post requests to unusual extensions.
Severity	Medium
Tactics	Persistence CommandAndControl
Techniques	T1505 T1071
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare CCF/Analytic Rules/CloudflareCCFUnexpectedPost.yaml
Version	1.0.1
Arm template	7313352a-09f6-4a84-88bd-6f17f1cbeb88.json

KQL

Cloudflare
| where HttpRequestMethod in~ ('POST', 'PUT')
| where tostring(HttpStatusCode) startswith '2'
| where DstBytes != 0 or SrcBytes != 0
| extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
| where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')

YAML

tactics:
- Persistence
- CommandAndControl
relevantTechniques:
- T1505
- T1071
version: 1.0.1
triggerOperator: gt
name: Cloudflare - Unexpected POST requests
id: 7313352a-09f6-4a84-88bd-6f17f1cbeb88
description: |
    'Detects post requests to unusual extensions.'
queryFrequency: 1h
severity: Medium
status: Available
query: |
  Cloudflare
  | where HttpRequestMethod in~ ('POST', 'PUT')
  | where tostring(HttpStatusCode) startswith '2'
  | where DstBytes != 0 or SrcBytes != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
  | where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare CCF/Analytic Rules/CloudflareCCFUnexpectedPost.yaml
queryPeriod: 1h
triggerThreshold: 0
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - Cloudflare
  connectorId: CloudflareDataConnector

ARM