App Gateway WAF - SQLi Detection

Status: available
Severity: high
Time window: 6h
Group by: Action, ClientIp, TransactionId, Uri
Source: github.com/Azure/Azure-Sentinel

'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/Top10/A03_2021-Injection/'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1211` Exploitation for Stealth
Privilege Escalation	`T0890` Exploitation for Privilege Escalation

Rule body

id: bdb2cd63-99f2-472e-b1b9-acba473b6744
name: App Gateway WAF - SQLi Detection  
description: | 
  'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.
  References: https://owasp.org/Top10/A03_2021-Injection/'
severity: High
status: Available
requiredDataConnectors: 
  - connectorId: WAF
    dataTypes: 
      - AzureDiagnostics
queryFrequency: 6h 
queryPeriod: 6h 
triggerOperator: gt 
triggerThreshold: 0 
tactics: 
  - DefenseEvasion
  - Execution
  - InitialAccess
  - PrivilegeEscalation 
relevantTechniques:
  - T1211
  - T1059
  - T1190
  - T0890
tags:
  - SQL Injection
query:  | 
 let Threshold = 3;  
 AGWFirewallLogs
 | where Action == "Matched"
 | where Message has "SQL Injection"
 | project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message
 | join kind = inner(
 AGWFirewallLogs
 | where Action == "Blocked"
 | extend transactionId_g = tostring(TransactionId)) on TransactionId
 | extend Uri = strcat(Hostname,RequestUri)
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action
 | where Total_TransactionId >= Threshold
# The Threshold value above can be changed as per your infrastructure's requirement
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Uri
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp 
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let Threshold = 3;

Stage 1: `source`

AGWFirewallLogs

Stage 2: `where`

| where Action == "Matched"

Stage 3: `where`

| where Message has "SQL Injection"

Stage 4: `project`

| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message

Stage 5: `join`

| join kind = inner(
AGWFirewallLogs
| where Action == "Blocked"
| extend transactionId_g = tostring(TransactionId)) on TransactionId

Stage 6: `extend`

| extend Uri = strcat(Hostname,RequestUri)

Stage 7: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action

Stage 8: `where`

| where Total_TransactionId >= Threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`Blocked` `Matched`	`field:"Action" kind:eq`
`Message`	match	`SQL Injection` transforms: `term`	`field:"Message" kind:match value:"SQL Injection"`
`Total_TransactionId`	ge	`3`	`field:"Total_TransactionId" kind:ge value:"3"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`summarize`
`ClientIp`	`summarize`
`EndTime`	`summarize`
`Message`	`summarize`
`StartTime`	`summarize`
`Total_TransactionId`	`summarize`
`TransactionID`	`summarize`
`Uri`	`summarize`

App Gateway WAF - SQLi Detection

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: join

Stage 6: extend

Stage 7: summarize

Stage 8: where