Cisco Umbrella - Crypto Miner User-Agent Detected

Back


Id	b619d1f1-7f39-4c7e-bf9e-afbb46457997
Rulename	Cisco Umbrella - Crypto Miner User-Agent Detected
Description	Detects suspicious user agent strings used by crypto miners in proxy logs.
Severity	Medium
Tactics	CommandAndControl
Required data connectors	CiscoUmbrellaDataConnector
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
Version	1.1.2
Arm template	b619d1f1-7f39-4c7e-bf9e-afbb46457997.json

KQL

let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal

YAML

queryPeriod: 15m
query: |
  let timeframe = 15m;
  Cisco_Umbrella
  | where EventType == "proxylogs"
  | where TimeGenerated > ago(timeframe)
  | where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
  | extend Message = "Crypto Miner User Agent"
  | project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal  
name: Cisco Umbrella - Crypto Miner User-Agent Detected
entityMappings:
- fieldMappings:
  - columnName: UrlOriginal
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
description: |
    'Detects suspicious user agent strings used by crypto miners in proxy logs.'
kind: Scheduled
version: 1.1.2
queryFrequency: 15m
severity: Medium
requiredDataConnectors:
- connectorId: CiscoUmbrellaDataConnector
  dataTypes:
  - Cisco_Umbrella_proxy_CL
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
id: b619d1f1-7f39-4c7e-bf9e-afbb46457997

ARM