Cisco Cloud Security - Request Allowed to harmful/malicious URI category

Status: available
Severity: medium
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

'It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content..'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols
Exfiltration	`T1041` Exfiltration Over C2 Channel

Rule body

id: d6bf1931-b1eb-448d-90b2-de118559c7ce
name: Cisco Cloud Security - Request Allowed to harmful/malicious URI category
description: |
  'It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content..'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CiscoUmbrellaDataConnector
    dataTypes:
      - Cisco_Umbrella_proxy_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1071.001
  - T1041
query: |
  Cisco_Umbrella
  | where EventType == 'proxylogs'
  | where DvcAction =~ 'Allowed'
  | where UrlCategory contains 'Adult Themes' or
        UrlCategory contains 'Adware' or
        UrlCategory contains 'Alcohol' or
        UrlCategory contains 'Illegal Downloads' or
        UrlCategory contains 'Drugs' or
        UrlCategory contains 'Child Abuse Content' or
        UrlCategory contains 'Hate/Discrimination' or
        UrlCategory contains 'Nudity' or
        UrlCategory contains 'Pornography' or
        UrlCategory contains 'Proxy/Anonymizer' or
        UrlCategory contains 'Sexuality' or
        UrlCategory contains 'Tasteless' or
        UrlCategory contains 'Terrorism' or
        UrlCategory contains 'Web Spam' or
        UrlCategory contains 'German Youth Protection' or
        UrlCategory contains 'Illegal Activities' or
        UrlCategory contains 'Lingerie/Bikini' or
        UrlCategory contains 'Weapons'
  | project TimeGenerated, SrcIpAddr, DstIpAddr, UrlOriginal, Identities
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: UrlOriginal
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.1.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Cisco_Umbrella

Stage 2: `where`

| where EventType == 'proxylogs'

Stage 3: `where`

| where DvcAction =~ 'Allowed'

Stage 4: `where`

| where UrlCategory contains 'Adult Themes' or
      UrlCategory contains 'Adware' or
      UrlCategory contains 'Alcohol' or
      UrlCategory contains 'Illegal Downloads' or
      UrlCategory contains 'Drugs' or
      UrlCategory contains 'Child Abuse Content' or
      UrlCategory contains 'Hate/Discrimination' or
      UrlCategory contains 'Nudity' or
      UrlCategory contains 'Pornography' or
      UrlCategory contains 'Proxy/Anonymizer' or
      UrlCategory contains 'Sexuality' or
      UrlCategory contains 'Tasteless' or
      UrlCategory contains 'Terrorism' or
      UrlCategory contains 'Web Spam' or
      UrlCategory contains 'German Youth Protection' or
      UrlCategory contains 'Illegal Activities' or
      UrlCategory contains 'Lingerie/Bikini' or
      UrlCategory contains 'Weapons'

Stage 5: `project`

| project TimeGenerated, SrcIpAddr, DstIpAddr, UrlOriginal, Identities

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DvcAction`	eq	`Allowed`	`field:"DvcAction" kind:eq value:"Allowed"`
`EventType`	eq	`proxylogs`	`field:"EventType" kind:eq value:"proxylogs"`
`UrlCategory`	contains	`Adult Themes` `Adware` `Alcohol` `Child Abuse Content` `Drugs` `German Youth Protection` `Hate/Discrimination` `Illegal Activities` `Illegal Downloads` `Lingerie/Bikini` `Nudity` `Pornography` `Proxy/Anonymizer` `Sexuality` `Tasteless` `Terrorism` `Weapons` `Web Spam`	`field:"UrlCategory" kind:contains`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstIpAddr`	`project`
`Identities`	`project`
`SrcIpAddr`	`project`
`TimeGenerated`	`project`
`UrlOriginal`	`project`

Cisco Cloud Security - Request Allowed to harmful/malicious URI category

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where