Cisco Umbrella - Crypto Miner User-Agent Detected

Back


Id	b619d1f1-7f39-4c7e-bf9e-afbb46457997
Rulename	Cisco Umbrella - Crypto Miner User-Agent Detected
Description	Detects suspicious user agent strings used by crypto miners in proxy logs.
Severity	Medium
Tactics	CommandAndControl
Required data connectors	CiscoUmbrellaDataConnector
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
Version	1.1.2
Arm template	b619d1f1-7f39-4c7e-bf9e-afbb46457997.json

KQL

let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal

YAML

tactics:
- CommandAndControl
id: b619d1f1-7f39-4c7e-bf9e-afbb46457997
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
triggerThreshold: 0
description: |
    'Detects suspicious user agent strings used by crypto miners in proxy logs.'
version: 1.1.2
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: UrlOriginal
  entityType: URL
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
kind: Scheduled
name: Cisco Umbrella - Crypto Miner User-Agent Detected
query: |
  let timeframe = 15m;
  Cisco_Umbrella
  | where EventType == "proxylogs"
  | where TimeGenerated > ago(timeframe)
  | where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
  | extend Message = "Crypto Miner User Agent"
  | project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal  
queryPeriod: 15m
queryFrequency: 15m
triggerOperator: gt
requiredDataConnectors:
- connectorId: CiscoUmbrellaDataConnector
  dataTypes:
  - Cisco_Umbrella_proxy_CL

ARM