API - API Scraping

Back


Id	d944d564-b6fa-470d-b5ab-41b341878c5e
Rulename	API - API Scraping
Description	42Crunch API protection against API scraping
Severity	High
Tactics	Reconnaissance Collection
Techniques	T1593 T1119
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAPIScaping.yaml
Version	3.0.1
Arm template	d944d564-b6fa-470d-b5ab-41b341878c5e.json

KQL

let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/properties?page=" and Status == 200;
let rateLimitCount = (toscalar(firstRec | count));
let recCount = iff((rateLimitCount > 100), 1, 0);
firstRec | top recCount by Timestamp desc;

YAML

status: Available
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
query: |
  let firstRec = FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where UriPath has "/api/properties?page=" and Status == 200;
  let rateLimitCount = (toscalar(firstRec | count));
  let recCount = iff((rateLimitCount > 100), 1, 0);
  firstRec | top recCount by Timestamp desc;  
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAPIScaping.yaml
tactics:
- Reconnaissance
- Collection
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InstanceName
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
kind: Scheduled
relevantTechniques:
- T1593
- T1119
customDetails: 
description: |
    '42Crunch API protection against API scraping'
name: API - API Scraping
version: 3.0.1
id: d944d564-b6fa-470d-b5ab-41b341878c5e
severity: High

ARM