Detection rules › Kusto
API - Invalid host access
'42Crunch API protection against invalid host access'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance |
Rule body
id: 28500be7-cfcf-40e1-bad4-bc524e9283e2
name: API - Invalid host access
description: |
'42Crunch API protection against invalid host access'
severity: Low
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Reconnaissance
relevantTechniques:
- T1592
query: |
FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| where ErrorMessage has "hostpath_mapping"
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid
| sort by TimeGenerated desc
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where TimeGenerated >= ago(5m)
Stage 3: where
| where ErrorMessage has "hostpath_mapping"
Stage 4: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid
Stage 5: sort
| sort by TimeGenerated desc
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ErrorMessage | match |
| field:"aws::errorMessage" kind:match value:"hostpath_mapping" |