CreepyDrive request URL sequence

Severity: high
Time window: 1d
Group by: SourceHostName, SourceIP
Author: Thomas McElroy
Source: github.com/Azure/Azure-Sentinel

'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths. This detecton will alert when over 20 sequences are observed in a single day.'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1102.002` Web Service: Bidirectional Communication
Exfiltration	`T1567.002` Exfiltration Over Web Service: Exfiltration to Cloud Storage

Rule body

id: eda260eb-f4a1-4379-ad98-452604da9b3e
name: CreepyDrive request URL sequence
description: |
  'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths.
  This detecton will alert when over 20 sequences are observed in a single day.'
severity: High
requiredDataConnectors:
  - connectorId: Zscaler
    dataTypes:
      - CommonSecurityLog
  - connectorId: Fortinet
    dataTypes:
      - CommonSecurityLog
  - connectorId: CheckPoint
    dataTypes:
      - CommonSecurityLog
  - connectorId: PaloAltoNetworks
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1567.002
  - T1102.002
tags:
  - POLONIUM
query: |
  let eventsThreshold = 20;
  CommonSecurityLog
  | where isnotempty(RequestURL)
  | project TimeGenerated, RequestURL, RequestMethod, SourceIP, SourceHostName
  | evaluate sequence_detect(TimeGenerated, 5s, 8s, login=(RequestURL has "login.microsoftonline.com/consumers/oauth2/v2.0/token"), graph=(RequestURL has "graph.microsoft.com/v1.0/me/drive/"), SourceIP, SourceHostName)
  | summarize Events=count() by SourceIP, SourceHostName
  | where Events >= eventsThreshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SourceHostName
version: 1.0.1
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Thomas McElroy
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

Stages and Predicates

Parameters

let eventsThreshold = 20;

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where isnotempty(RequestURL)

Stage 3: `project`

| project TimeGenerated, RequestURL, RequestMethod, SourceIP, SourceHostName

Stage 4: `evaluate`

| evaluate sequence_detect(TimeGenerated, 5s, 8s, login=(RequestURL has "login.microsoftonline.com/consumers/oauth2/v2.0/token"), graph=(RequestURL has "graph.microsoft.com/v1.0/me/drive/"), SourceIP, SourceHostName)

Stage 5: `summarize`

| summarize Events=count() by SourceIP, SourceHostName

Stage 6: `where`

| where Events >= eventsThreshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Events`	ge	`20`	`field:"Events" kind:ge value:"20"`
`RequestURL`	is_not_null	(no value, null check)	`field:"RequestURL" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Events`	`summarize`
`SourceHostName`	`summarize`
`SourceIP`	`summarize`

CreepyDrive request URL sequence

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: project

Stage 4: evaluate

Stage 5: summarize

Stage 6: where