Cloudflare - Unexpected POST requests

Back


Id	7313352a-09f6-4a84-88bd-6f17f1cbeb8f
Rulename	Cloudflare - Unexpected POST requests
Description	Detects post requests to unusual extensions.
Severity	Medium
Tactics	Persistence CommandAndControl
Techniques	T1505 T1071
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedPost.yaml
Version	1.0.0
Arm template	7313352a-09f6-4a84-88bd-6f17f1cbeb8f.json

KQL

Cloudflare
| where HttpRequestMethod in~ ('POST', 'PUT')
| where tostring(HttpStatusCode) startswith '2'
| where DstBytes != 0 or SrcBytes != 0
| extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
| where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')
| extend IPCustomEntity = SrcIpAddr

YAML

tactics:
- Persistence
- CommandAndControl
query: |
  Cloudflare
  | where HttpRequestMethod in~ ('POST', 'PUT')
  | where tostring(HttpStatusCode) startswith '2'
  | where DstBytes != 0 or SrcBytes != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
  | where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- dataTypes:
  - Cloudflare
  connectorId: CloudflareDataConnector
name: Cloudflare - Unexpected POST requests
kind: Scheduled
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedPost.yaml
triggerThreshold: 0
description: |
    'Detects post requests to unusual extensions.'
version: 1.0.0
status: Available
queryFrequency: 1h
severity: Medium
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerOperator: gt
id: 7313352a-09f6-4a84-88bd-6f17f1cbeb8f
relevantTechniques:
- T1505
- T1071

ARM