API - Suspicious Login

Back


Id	7bdc10d6-aa24-4ca9-9a93-802cd8761354
Rulename	API - Suspicious Login
Description	42Crunch API protection against suspicious login
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1110 T1190
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APISuspiciousLogin.yaml
Version	1.0.1
Arm template	7bdc10d6-aa24-4ca9-9a93-802cd8761354.json

KQL

let firstRec = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
| where Instance_Name_s == "Instance_6" and URI_Path_s has "/api/login?user=" and Status_d in (200, 403);
let ipAddressCount = toscalar(firstRec | summarize by Source_IP_s | count);
let secondRec = firstRec | summarize arg_max(Source_IP_s, *) by Source_IP_s;
let recCount = iff((toscalar(secondRec | count) > 3), ipAddressCount, 0);
secondRec | take recCount

YAML

description: |
    '42Crunch API protection against suspicious login'
entityMappings:
- fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName
  entityType: Account
query: |
  let firstRec = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
  | where Instance_Name_s == "Instance_6" and URI_Path_s has "/api/login?user=" and Status_d in (200, 403);
  let ipAddressCount = toscalar(firstRec | summarize by Source_IP_s | count);
  let secondRec = firstRec | summarize arg_max(Source_IP_s, *) by Source_IP_s;
  let recCount = iff((toscalar(secondRec | count) > 3), ipAddressCount, 0);
  secondRec | take recCount  
tactics:
- CredentialAccess
- InitialAccess
severity: High
triggerThreshold: 0
queryFrequency: 5m
status: Available
queryPeriod: 5m
relevantTechniques:
- T1110
- T1190
version: 1.0.1
id: 7bdc10d6-aa24-4ca9-9a93-802cd8761354
name: API - Suspicious Login
kind: Scheduled
triggerOperator: gt
customDetails: 
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APISuspiciousLogin.yaml
requiredDataConnectors:
- dataTypes:
  - apifirewall_log_1_CL
  connectorId: 42CrunchAPIProtection

ARM