MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | T1589 Gather Victim Identity Information, T1593 Search Open Websites/Domains |
Rule body kusto
id: 2c59e609-e0a0-4e8e-adc5-ab4224be8a36
name: API - Anomaly Detection
description: |
'42Crunch API protection anomaly detection'
severity: Low
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Reconnaissance
relevantTechniques:
- T1593
- T1589
query: |
let infoRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/info" and Status == 200;
let timestamp = toscalar(infoRec | top 1 by Timestamp desc | summarize by Timestamp);
let activityRec = FortyTwoCrunchAPIProtection
| where Timestamp < timestamp and TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/activity" and Status == 200;
activityRec
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Let binding: infoRec
let infoRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/info" and Status == 200;
Let binding: timestamp
let timestamp = toscalar(infoRec | top 1 by Timestamp desc | summarize by Timestamp);
Derived from infoRec.
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where Timestamp < timestamp and TimeGenerated >= ago(5m)
References timestamp (defined above).
Stage 3: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
Stage 4: where
| where UriPath has "/api/users/activity" and Status == 200
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.