Apache - Request from private IP

Back


Id	a0077556-3aff-11ec-8d3d-0242ac130003
Rulename	Apache - Request from private IP
Description	Detects requests from private IP
Severity	Medium
Tactics	Impact InitialAccess
Techniques	T1498 T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestFromPrivateIP.yaml
Version	1.0.2
Arm template	a0077556-3aff-11ec-8d3d-0242ac130003.json

KQL

ApacheHTTPServer
| where ipv4_is_private(SrcIpAddr)
| extend IPCustomEntity = SrcIpAddr

YAML

requiredDataConnectors:
- datatypes:
  - ApacheHTTPServer_CL
  connectorId: CustomLogsAma
queryPeriod: 1h
triggerThreshold: 0
queryFrequency: 1h
version: 1.0.2
status: Available
severity: Medium
description: |
    'Detects requests from private IP'
name: Apache - Request from private IP
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
triggerOperator: gt
id: a0077556-3aff-11ec-8d3d-0242ac130003
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestFromPrivateIP.yaml
tactics:
- Impact
- InitialAccess
relevantTechniques:
- T1498
- T1190
- T1133
kind: Scheduled
query: |
  ApacheHTTPServer
  | where ipv4_is_private(SrcIpAddr)
  | extend IPCustomEntity = SrcIpAddr

ARM