API - JWT validation

Back


Id	bbd163f4-1f56-434f-9c23-b06713c119c2
Rulename	API - JWT validation
Description	42Crunch API protection against JWT validation
Severity	Low
Tactics	InitialAccess CredentialAccess
Techniques	T1190 T1528
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIJWTValidation.yaml
Version	3.0.1
Arm template	bbd163f4-1f56-434f-9c23-b06713c119c2.json

KQL

FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| where ErrorMessage has "missing [\"x-access-token\"]" 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid 
| sort by TimeGenerated desc

YAML

status: Available
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
query: |
  FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | where ErrorMessage has "missing [\"x-access-token\"]" 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid 
  | sort by TimeGenerated desc   
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIJWTValidation.yaml
tactics:
- InitialAccess
- CredentialAccess
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InstanceName
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
kind: Scheduled
relevantTechniques:
- T1190
- T1528
customDetails: 
description: |
    '42Crunch API protection against JWT validation'
name: API - JWT validation
version: 3.0.1
id: bbd163f4-1f56-434f-9c23-b06713c119c2
severity: Low

ARM