MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110 Brute Force |
| Discovery | T1087 Account Discovery |
Rule body kusto
id: 25c86f99-0a91-4b7f-88f3-599a008e5ab8
name: API - Account Takeover
description: |
'42Crunch API protection against account takeover'
severity: High
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- CredentialAccess
- Discovery
relevantTechniques:
- T1110
- T1087
query: |
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where (UriPath has "/api/register" or UriPath has "/api/reset") and Status == 403;
let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
firstRec | take recCount
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Let binding: recCount
let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
Derived from firstRec.
The stages below define let firstRec (the rule's main pipeline source).
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where TimeGenerated >= ago(5m)
Stage 3: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
Stage 4: where
| where (UriPath has "/api/register" or UriPath has "/api/reset") and Status == 403
The stages below run on firstRec (the outer pipeline).
Stage 5: take
firstRec
| take recCount
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.