detection.wiki

Detection rules › Kusto

Cisco Umbrella - Request Allowed to harmful/malicious URI category

Severity
medium
Time window
10m
Source
github.com/Azure/Azure-Sentinel

'It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content..'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessNo specific technique
Command & ControlNo specific technique

Rule body

id: d6bf1931-b1eb-448d-90b2-de118559c7ce
name: Cisco Umbrella - Request Allowed to harmful/malicious URI category
description: |
  'It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content..'
severity: Medium
requiredDataConnectors:
  - connectorId: CiscoUmbrellaDataConnector
    dataTypes:
      - Cisco_Umbrella_proxy_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
  - InitialAccess
query: |
  let lbtime = 10m;
  Cisco_Umbrella
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'proxylogs'
  | where DvcAction =~ 'Allowed'
  | where UrlCategory contains 'Adult Themes' or
        UrlCategory contains 'Adware' or
        UrlCategory contains 'Alcohol' or
        UrlCategory contains 'Illegal Downloads' or
        UrlCategory contains 'Drugs' or
        UrlCategory contains 'Child Abuse Content' or
        UrlCategory contains 'Hate/Discrimination' or
        UrlCategory contains 'Nudity' or
        UrlCategory contains 'Pornography' or
        UrlCategory contains 'Proxy/Anonymizer' or
        UrlCategory contains 'Sexuality' or
        UrlCategory contains 'Tasteless' or
        UrlCategory contains 'Terrorism' or
        UrlCategory contains 'Web Spam' or
        UrlCategory contains 'German Youth Protection' or
        UrlCategory contains 'Illegal Activities' or
        UrlCategory contains 'Lingerie/Bikini' or
        UrlCategory contains 'Weapons'
  | project TimeGenerated, SrcIpAddr, Identities
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Identities
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.1.1
kind: Scheduled

Stages and Predicates

Parameters

let lbtime = 10m;

Stage 1: source

Cisco_Umbrella

Stage 2: where

| where TimeGenerated > ago(lbtime)

Stage 3: where

| where EventType == 'proxylogs'

Stage 4: where

| where DvcAction =~ 'Allowed'

Stage 5: where

| where UrlCategory contains 'Adult Themes' or
      UrlCategory contains 'Adware' or
      UrlCategory contains 'Alcohol' or
      UrlCategory contains 'Illegal Downloads' or
      UrlCategory contains 'Drugs' or
      UrlCategory contains 'Child Abuse Content' or
      UrlCategory contains 'Hate/Discrimination' or
      UrlCategory contains 'Nudity' or
      UrlCategory contains 'Pornography' or
      UrlCategory contains 'Proxy/Anonymizer' or
      UrlCategory contains 'Sexuality' or
      UrlCategory contains 'Tasteless' or
      UrlCategory contains 'Terrorism' or
      UrlCategory contains 'Web Spam' or
      UrlCategory contains 'German Youth Protection' or
      UrlCategory contains 'Illegal Activities' or
      UrlCategory contains 'Lingerie/Bikini' or
      UrlCategory contains 'Weapons'

Stage 6: project

| project TimeGenerated, SrcIpAddr, Identities

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DvcActioneq
  • Allowed
field:"DvcAction" kind:eq value:"Allowed"
EventTypeeq
  • proxylogs
field:"EventType" kind:eq value:"proxylogs"
UrlCategorycontains
  • Adult Themes
  • Adware
  • Alcohol
  • Child Abuse Content
  • Drugs
  • German Youth Protection
  • Hate/Discrimination
  • Illegal Activities
  • Illegal Downloads
  • Lingerie/Bikini
  • Nudity
  • Pornography
  • Proxy/Anonymizer
  • Sexuality
  • Tasteless
  • Terrorism
  • Weapons
  • Web Spam
field:"UrlCategory" kind:contains

Output fields

These fields are emitted when the rule matches.

FieldSource
Identitiesproject
SrcIpAddrproject
TimeGeneratedproject