Cloudflare - Unexpected client request

Back


Id	f32142b1-4bcb-45c0-92e4-2ddc18768522
Rulename	Cloudflare - Unexpected client request
Description	Detects client requests to unusual client request.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedRequest.yaml
Version	1.0.1
Arm template	f32142b1-4bcb-45c0-92e4-2ddc18768522.json

KQL

Cloudflare
| where HttpRequestMethod =~ 'GET'
| where DstBytes != 0 or SrcBytes != 0
| where ClientRequestURI has_any ('/admin', '/admin.php', 'wp-admin', '.htaccess', '/etc/shadow', '/etc/passwd', '/etc/hosts', '/etc/ssh/') 
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 1h
query: |
  Cloudflare
  | where HttpRequestMethod =~ 'GET'
  | where DstBytes != 0 or SrcBytes != 0
  | where ClientRequestURI has_any ('/admin', '/admin.php', 'wp-admin', '.htaccess', '/etc/shadow', '/etc/passwd', '/etc/hosts', '/etc/ssh/') 
  | extend IPCustomEntity = SrcIpAddr  
name: Cloudflare - Unexpected client request
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedRequest.yaml
requiredDataConnectors:
- connectorId: CloudflareDataConnector
  dataTypes:
  - Cloudflare
description: |
    'Detects client requests to unusual client request.'
kind: Scheduled
version: 1.0.1
status: Available
severity: Medium
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: f32142b1-4bcb-45c0-92e4-2ddc18768522

ARM