Excessive Denied Proxy Traffic

Back


Id	7a58b253-0ef2-4248-b4e5-c350f15a8346
Rulename	Excessive Denied Proxy Traffic
Description	This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.
Severity	Low
Tactics	DefenseEvasion CommandAndControl
Techniques	T1090 T1562
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
Version	1.0.5
Arm template	7a58b253-0ef2-4248-b4e5-c350f15a8346.json

KQL

let threshold = 100;
SymantecProxySG
| where sc_filter_result =~ "DENIED"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
| where count_ > threshold

YAML

triggerThreshold: 0
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: cs_host
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: c_ip
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
name: Excessive Denied Proxy Traffic
relevantTechniques:
- T1090
- T1562
status: Available
version: 1.0.5
queryPeriod: 1h
kind: Scheduled
id: 7a58b253-0ef2-4248-b4e5-c350f15a8346
query: |
  let threshold = 100;
  SymantecProxySG
  | where sc_filter_result =~ "DENIED"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
  | where count_ > threshold  
description: |
    'This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.'
queryFrequency: 1h
severity: Low
triggerOperator: gt
tactics:
- DefenseEvasion
- CommandAndControl

ARM