App Gateway WAF - XSS Detection

Status: available
Severity: high
Time window: 6h
Group by: Action, ClientIp, TransactionId, Uri
Source: github.com/Azure/Azure-Sentinel

'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-community/attacks/xss/'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1189` Drive-by Compromise
Execution	`T1203` Exploitation for Client Execution
Execution	`T0853` Scripting

Rule body

id: 1c7ff502-2ad4-4970-9d29-9210c6753138
name: App Gateway WAF - XSS Detection
description: | 
  'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.
   References: https://owasp.org/www-community/attacks/xss/'
severity: High
status: Available
requiredDataConnectors: 
  - connectorId: WAF 
    dataTypes: 
      - AzureDiagnostics
queryFrequency: 6h 
queryPeriod: 6h 
triggerOperator: gt 
triggerThreshold: 0 
tactics: 
  - InitialAccess
  - Execution
relevantTechniques:
  - T1189
  - T1203
  - T0853
tags:
  - Cross Site Scripting
query:  |  
 let Threshold = 3;  
 AGWFirewallLogs
 | where Action == "Matched"
 | where Message has "XSS"
 | project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message
 | join kind = inner(
 AGWFirewallLogs
 | where Action == "Blocked"
 | extend transactionId_g = tostring(TransactionId)) on TransactionId
 | extend Uri = strcat(Hostname,RequestUri)
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action
 | where Total_TransactionId >= Threshold
# The Threshold value above can be changed as per your infrastructure's requirement 
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Uri
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let Threshold = 3;

Stage 1: `source`

AGWFirewallLogs

Stage 2: `where`

| where Action == "Matched"

Stage 3: `where`

| where Message has "XSS"

Stage 4: `project`

| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message

Stage 5: `join`

| join kind = inner(
AGWFirewallLogs
| where Action == "Blocked"
| extend transactionId_g = tostring(TransactionId)) on TransactionId

Stage 6: `extend`

| extend Uri = strcat(Hostname,RequestUri)

Stage 7: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action

Stage 8: `where`

| where Total_TransactionId >= Threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`Blocked` `Matched`	`field:"Action" kind:eq`
`Message`	match	`XSS` transforms: `term`	`field:"Message" kind:match value:"XSS"`
`Total_TransactionId`	ge	`3`	`field:"Total_TransactionId" kind:ge value:"3"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`summarize`
`ClientIp`	`summarize`
`EndTime`	`summarize`
`Message`	`summarize`
`StartTime`	`summarize`
`Total_TransactionId`	`summarize`
`TransactionID`	`summarize`
`Uri`	`summarize`

App Gateway WAF - XSS Detection

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: join

Stage 6: extend

Stage 7: summarize

Stage 8: where