PaloAlto - Put and post method request in high risk file type

Back


Id	f12e9d10-51ca-11ec-bf63-0242ac130002
Rulename	PaloAlto - Put and post method request in high risk file type
Description	Detects put and post method request in high risk file type.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml
Version	1.0.4
Arm template	f12e9d10-51ca-11ec-bf63-0242ac130002.json

KQL

let HighRiskFileType = dynamic(['.exe', '.msi', '.msp', '.jar', '.bat', '.cmd', '.js', '.jse', 'ws', '.ps1', '.ps2', '.msh']);
PaloAltoCDLEvent
| where EventResourceId =~ 'THREAT'
| where EventResult =~ 'file'
| where HttpRequestMethod has_any ("POST", "PUT")
| where FileType in (HighRiskFileType)
| extend FileCustomEntity = SrcFileName

YAML

relevantTechniques:
- T1190
- T1133
entityMappings:
- entityType: File
  fieldMappings:
  - columnName: FileCustomEntity
    identifier: Name
version: 1.0.4
id: f12e9d10-51ca-11ec-bf63-0242ac130002
severity: High
kind: Scheduled
queryFrequency: 10m
description: |
    'Detects put and post method request in high risk file type.'
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
triggerOperator: gt
name: PaloAlto - Put and post method request in high risk file type
tactics:
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml
triggerThreshold: 0
queryPeriod: 10m
query: |
  let HighRiskFileType = dynamic(['.exe', '.msi', '.msp', '.jar', '.bat', '.cmd', '.js', '.jse', 'ws', '.ps1', '.ps2', '.msh']);
  PaloAltoCDLEvent
  | where EventResourceId =~ 'THREAT'
  | where EventResult =~ 'file'
  | where HttpRequestMethod has_any ("POST", "PUT")
  | where FileType in (HighRiskFileType)
  | extend FileCustomEntity = SrcFileName  
status: Available

ARM