MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: 010644fd-2830-4451-9e0e-606cc192f2e7
name: Cisco WSA - Unexpected URL
description: |
'Detects unexpected URL.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
relevantTechniques:
- T1102
query: |
let threshold = 5;
CiscoWSAEvent
| where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
| extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: URLCustomEntity
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Parameters
let threshold = 5;
Stage 1: source
CiscoWSAEvent
Stage 2: where
| where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
Stage 3: extend
| extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
UrlOriginal | regex_match |
| field:"UrlOriginal" kind:regex_match value:"\Ahttp(s)?[:][/][/]\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountCustomEntity | extend |
URLCustomEntity | extend |