let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal
queryFrequency: 15m
id: b619d1f1-7f39-4c7e-bf9e-afbb46457997
tactics:
- CommandAndControl
entityMappings:
- fieldMappings:
- columnName: UrlOriginal
identifier: Url
entityType: URL
- fieldMappings:
- columnName: SrcIpAddr
identifier: Address
entityType: IP
requiredDataConnectors:
- connectorId: CiscoUmbrellaDataConnector
dataTypes:
- Cisco_Umbrella_proxy_CL
version: 1.1.2
query: |
let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal
description: |
'Detects suspicious user agent strings used by crypto miners in proxy logs.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
triggerThreshold: 0
queryPeriod: 15m
triggerOperator: gt
name: Cisco Umbrella - Crypto Miner User-Agent Detected
severity: Medium
kind: Scheduled
