Apache - Known malicious user agent

Back


Id	e9edfe1c-3afd-11ec-8d3d-0242ac130003
Rulename	Apache - Known malicious user agent
Description	Detects known malicious user agents
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheKnownMaliciousUserAgents.yaml
Version	1.0.3
Arm template	e9edfe1c-3afd-11ec-8d3d-0242ac130003.json

KQL

let mal_uas = dynamic(['Metasploit', '360Spider', '404checker', 'AllSubmitter', 'BackDoorBot', 'CATExplorador', 'Nikto', 'havij']);
ApacheHTTPServer
| where HttpUserAgentOriginal has_any (mal_uas)
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 10m
query: |
  let mal_uas = dynamic(['Metasploit', '360Spider', '404checker', 'AllSubmitter', 'BackDoorBot', 'CATExplorador', 'Nikto', 'havij']);
  ApacheHTTPServer
  | where HttpUserAgentOriginal has_any (mal_uas)
  | extend IPCustomEntity = SrcIpAddr  
name: Apache - Known malicious user agent
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheKnownMaliciousUserAgents.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ApacheHTTPServer_CL
description: |
    'Detects known malicious user agents'
kind: Scheduled
version: 1.0.3
status: Available
severity: High
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: e9edfe1c-3afd-11ec-8d3d-0242ac130003

ARM