MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
| Discovery | T1087 Account Discovery |
Rule body kusto
id: c6258d51-7b82-4942-8293-94c1dcf91595
name: API - Rate limiting
description: |
'42Crunch API protection against first-time access'
severity: Low
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Discovery
- InitialAccess
relevantTechniques:
- T1087
- T1190
query: |
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login" |
top 1 by Timestamp desc;
let ipAddress = toscalar(firstRec | summarize by SourceIp);
let secondRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(7d)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login" and SourceIp == ipAddress;
let recCount = iff((toscalar(secondRec | count) > 1), 0, 1);
secondRec | take recCount
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Let binding: firstRec
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login" |
top 1 by Timestamp desc;
Let binding: ipAddress
let ipAddress = toscalar(firstRec | summarize by SourceIp);
Derived from firstRec.
Let binding: recCount
let recCount = iff((toscalar(secondRec | count) > 1), 0, 1);
Derived from secondRec.
The stages below define let secondRec (the rule's main pipeline source).
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where TimeGenerated >= ago(7d)
Stage 3: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
Stage 4: where
| where UriPath has "/api/login" and SourceIp == ipAddress
References ipAddress (defined above).
The stages below run on secondRec (the outer pipeline).
Stage 5: take
secondRec
| take recCount
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.