Excessive Denied Proxy Traffic

Back


Id	7a58b253-0ef2-4248-b4e5-c350f15a8346
Rulename	Excessive Denied Proxy Traffic
Description	This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.
Severity	Low
Tactics	DefenseEvasion CommandAndControl
Techniques	T1090 T1562
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
Version	1.0.5
Arm template	7a58b253-0ef2-4248-b4e5-c350f15a8346.json

KQL

let threshold = 100;
SymantecProxySG
| where sc_filter_result =~ "DENIED"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
| where count_ > threshold

YAML

id: 7a58b253-0ef2-4248-b4e5-c350f15a8346
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
queryPeriod: 1h
status: Available
name: Excessive Denied Proxy Traffic
triggerThreshold: 0
relevantTechniques:
- T1090
- T1562
kind: Scheduled
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
severity: Low
query: |
  let threshold = 100;
  SymantecProxySG
  | where sc_filter_result =~ "DENIED"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
  | where count_ > threshold  
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: cs_host
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: c_ip
  entityType: IP
tactics:
- DefenseEvasion
- CommandAndControl
version: 1.0.5
triggerOperator: gt
description: |
    'This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.'

ARM