MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | T1593 Search Open Websites/Domains |
| Collection | T1119 Automated Collection |
Rule body kusto
id: d944d564-b6fa-470d-b5ab-41b341878c5e
name: API - API Scraping
description: |
'42Crunch API protection against API scraping'
severity: High
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Reconnaissance
- Collection
relevantTechniques:
- T1593
- T1119
query: |
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/properties?page=" and Status == 200;
let rateLimitCount = (toscalar(firstRec | count));
let recCount = iff((rateLimitCount > 100), 1, 0);
firstRec | top recCount by Timestamp desc;
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Parameters
let recCount = iff((rateLimitCount > 100), 1, 0);
Let binding: rateLimitCount
let rateLimitCount = (toscalar(firstRec | count));
Derived from firstRec.
The stages below define let firstRec (the rule's main pipeline source).
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where TimeGenerated >= ago(5m)
Stage 3: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
Stage 4: where
| where UriPath has "/api/properties?page=" and Status == 200
The stages below run on firstRec (the outer pipeline).
Stage 5: top
firstRec
| top recCount by Timestamp desc;
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.