API - API Scraping

Back


Id	d944d564-b6fa-470d-b5ab-41b341878c5e
Rulename	API - API Scraping
Description	42Crunch API protection against API scraping
Severity	High
Tactics	Reconnaissance Collection
Techniques	T1593 T1119
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAPIScaping.yaml
Version	1.0.1
Arm template	d944d564-b6fa-470d-b5ab-41b341878c5e.json

KQL

let firstRec = apifirewall_log_1_CL
| where TimeGenerated >= ago(5m) 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
| where Instance_Name_s == "Instance_7" and URI_Path_s has "/api/properties?page=" and Status_d == 200;
let rateLimitCount = (toscalar(firstRec | count));
let recCount = iff((rateLimitCount > 100), 1, 0);
firstRec | top recCount by Timestamp_t desc;

YAML

version: 1.0.1
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAPIScaping.yaml
name: API - API Scraping
triggerThreshold: 0
tactics:
- Reconnaissance
- Collection
severity: High
status: Available
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - apifirewall_log_1_CL
  connectorId: 42CrunchAPIProtection
customDetails: 
id: d944d564-b6fa-470d-b5ab-41b341878c5e
query: |
  let firstRec = apifirewall_log_1_CL
  | where TimeGenerated >= ago(5m) 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Request_Header_s, Response_Header_s, Errors_s, Type, UUID_g
  | where Instance_Name_s == "Instance_7" and URI_Path_s has "/api/properties?page=" and Status_d == 200;
  let rateLimitCount = (toscalar(firstRec | count));
  let recCount = iff((rateLimitCount > 100), 1, 0);
  firstRec | top recCount by Timestamp_t desc;  
queryPeriod: 5m
triggerOperator: gt
relevantTechniques:
- T1593
- T1119
entityMappings:
- fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName
  entityType: Account
description: |
    '42Crunch API protection against API scraping'

ARM