Excessive Denied Proxy Traffic

Back


Id	7a58b253-0ef2-4248-b4e5-c350f15a8346
Rulename	Excessive Denied Proxy Traffic
Description	This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.
Severity	Low
Tactics	DefenseEvasion CommandAndControl
Techniques	T1090 T1562
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
Version	1.0.5
Arm template	7a58b253-0ef2-4248-b4e5-c350f15a8346.json

KQL

let threshold = 100;
SymantecProxySG
| where sc_filter_result =~ "DENIED"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
| where count_ > threshold

YAML

description: |
    'This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.'
kind: Scheduled
tactics:
- DefenseEvasion
- CommandAndControl
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SymantecProxySG/Analytic Rules/ExcessiveDeniedProxyTraffic.yaml
severity: Low
name: Excessive Denied Proxy Traffic
triggerThreshold: 0
queryPeriod: 1h
query: |
  let threshold = 100;
  SymantecProxySG
  | where sc_filter_result =~ "DENIED"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
  | where count_ > threshold  
relevantTechniques:
- T1090
- T1562
id: 7a58b253-0ef2-4248-b4e5-c350f15a8346
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.5
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: cs_host
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: c_ip
    identifier: Address

ARM