Cloudflare - Unexpected POST requests

Back


Id	7313352a-09f6-4a84-88bd-6f17f1cbeb8f
Rulename	Cloudflare - Unexpected POST requests
Description	Detects post requests to unusual extensions.
Severity	Medium
Tactics	Persistence CommandAndControl
Techniques	T1505 T1071
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedPost.yaml
Version	1.0.1
Arm template	7313352a-09f6-4a84-88bd-6f17f1cbeb8f.json

KQL

Cloudflare
| where HttpRequestMethod in~ ('POST', 'PUT')
| where tostring(HttpStatusCode) startswith '2'
| where DstBytes != 0 or SrcBytes != 0
| extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
| where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')

YAML

query: |
  Cloudflare
  | where HttpRequestMethod in~ ('POST', 'PUT')
  | where tostring(HttpStatusCode) startswith '2'
  | where DstBytes != 0 or SrcBytes != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, ClientRequestURI)
  | where fe in~ ('.jpg', '.jpeg', '.gif', '.png', '.icon', '.ico', '.xml', '.swf', '.svg', '.ppt', '.pttx', '.doc', '.docx', '.rtf', '.pdf', '.tif', '.zip', '.mov')  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
triggerThreshold: 0
name: Cloudflare - Unexpected POST requests
severity: Medium
relevantTechniques:
- T1505
- T1071
queryPeriod: 1h
tactics:
- Persistence
- CommandAndControl
requiredDataConnectors:
- connectorId: CloudflareDataConnector
  dataTypes:
  - Cloudflare
queryFrequency: 1h
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedPost.yaml
id: 7313352a-09f6-4a84-88bd-6f17f1cbeb8f
kind: Scheduled
description: |
    'Detects post requests to unusual extensions.'
status: Available
triggerOperator: gt

ARM