let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: UrlOriginal
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SrcIpAddr
tactics:
- CommandAndControl
requiredDataConnectors:
- dataTypes:
- Cisco_Umbrella_proxy_CL
connectorId: CiscoUmbrellaDataConnector
id: b619d1f1-7f39-4c7e-bf9e-afbb46457997
severity: Medium
query: |
let timeframe = 15m;
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal contains "XMRig" or HttpUserAgentOriginal contains "ccminer"
| extend Message = "Crypto Miner User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated,HttpUserAgentOriginal
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml
kind: Scheduled
queryPeriod: 15m
version: 1.1.2
name: Cisco Umbrella - Crypto Miner User-Agent Detected
queryFrequency: 15m
triggerThreshold: 0
description: |
'Detects suspicious user agent strings used by crypto miners in proxy logs.'
triggerOperator: gt
