Web Application attack detected

Status: available
Severity: high
Time window: 1d
Group by: SourceIp, ThreatCategory
Source: github.com/Azure/Azure-Sentinel

Identifies Web application attack in Azure Firewall IDPS logs.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: 8159a8d2-13a5-49af-847b-e062c45ab92b
name: Web Application attack detected
description: |
  Identifies Web application attack in Azure Firewall IDPS logs.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AzureFirewall
    dataTypes:
      - AZFWIdpsSignature
queryFrequency: 1h
queryPeriod: 24h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  let TimeWindow   = 90d;    
  let HitThreshold = 10;     
  let MinSeverity  = 2;
  let EnableCategoryFilter    = true;
  let EnableDescriptionFilter = false;
  let EnableActionFilter      = false;
  let CategoriesOfInterest = dynamic([
      "access to a potentially vulnerable web application",
      "Web Application Attack"
  ]);
  let DescriptionsOfInterest = dynamic([
      "web-application-activity",
      "web-application-attack"
  ]);
  let MatchActions = dynamic(["Deny", "alert"]);
  AZFWIdpsSignature
  | where TimeGenerated >= ago(TimeWindow)
  | where Severity >= MinSeverity
  | where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
  | where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
  | where (EnableActionFilter == false) or (Action in~ (MatchActions))
  | summarize
      StartTime   = min(TimeGenerated),
      EndTime     = max(TimeGenerated),
      TotalHits   = count(),
      MaxSeverity = max(Severity),
      Actions     = make_set(Action, 5),
      Signatures  = make_set(SignatureId, 20),
      Description = make_set(substring(tostring(Description), 0, 120), 3)
      by SourceIp, ThreatCategory = Category
  | where TotalHits >= HitThreshold
  | project
      StartTime,
      EndTime,
      SourceIp,
      ThreatCategory,
      TotalHits,
      MaxSeverity,
      Actions,
      Signatures,
      Description
  | order by MaxSeverity desc, TotalHits desc
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIp
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let TimeWindow = 90d;
let HitThreshold = 10;
let MinSeverity = 2;
let EnableCategoryFilter = true;
let EnableDescriptionFilter = false;
let EnableActionFilter = false;
let MatchActions = dynamic(["Deny", "alert"]);

Let binding: `CategoriesOfInterest` used in Stage 4

let CategoriesOfInterest = dynamic([
    "access to a potentially vulnerable web application",
    "Web Application Attack"
]);

Let binding: `DescriptionsOfInterest` used in Stage 5

let DescriptionsOfInterest = dynamic([
    "web-application-activity",
    "web-application-attack"
]);

Stage 1: `source`

AZFWIdpsSignature

Stage 2: `where`

| where TimeGenerated >= ago(TimeWindow)

Stage 3: `where`

| where Severity >= MinSeverity

Stage 4: `where`

| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))

Stage 5: `where`

| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))

Stage 6: `where`

| where (EnableActionFilter == false) or (Action in~ (MatchActions))

Stage 7: `summarize`

| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category

Stage 8: `where`

| where TotalHits >= HitThreshold

Stage 9: `project`

| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description

Stage 10: `sort`

| order by MaxSeverity desc, TotalHits desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	in	`Deny` `alert`	`field:"Action" kind:in`
`Category`	match	`Web Application Attack` transforms: `term` `access to a potentially vulnerable web application` transforms: `term`	`field:"Category" kind:match`
`Description`	match	`web-application-activity` transforms: `term` `web-application-attack` transforms: `term`	`field:"Description" kind:match`
`Severity`	ge	`2`	`field:"Severity" kind:ge value:"2"`
`TotalHits`	ge	`10`	`field:"TotalHits" kind:ge value:"10"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`project`
`Description`	`project`
`EndTime`	`project`
`MaxSeverity`	`project`
`Signatures`	`project`
`SourceIp`	`project`
`StartTime`	`project`
`ThreatCategory`	`project`
`TotalHits`	`project`

Web Application attack detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: CategoriesOfInterest used in Stage 4

Let binding: DescriptionsOfInterest used in Stage 5

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: summarize

Stage 8: where

Stage 9: project

Stage 10: sort

Indicators

Output fields

Let binding: `CategoriesOfInterest` used in Stage 4

Let binding: `DescriptionsOfInterest` used in Stage 5

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `where`

Stage 6: `where`

Stage 7: `summarize`

Stage 8: `where`

Stage 9: `project`

Stage 10: `sort`