Excessive Denied Proxy Traffic

Status: available
Severity: low
Time window: 1h
Group by: c_ip, cs_host
Source: github.com/Azure/Azure-Sentinel

'This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.'

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools
Command & Control	`T1090` Proxy

Rule body

id: 7a58b253-0ef2-4248-b4e5-c350f15a8346
name: Excessive Denied Proxy Traffic
description: |
  'This alert creates an incident when a client generates an excessive amounts of denied proxy traffic.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1090
  - T1562
query: |
  let threshold = 100;
  SymantecProxySG
  | where sc_filter_result =~ "DENIED"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host
  | where count_ > threshold
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: cs_host
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: c_ip
version: 1.0.5
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 100;

Stage 1: `source`

SymantecProxySG

Stage 2: `where`

| where sc_filter_result =~ "DENIED"

Stage 3: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by c_ip, cs_host

Stage 4: `where`

| where count_ > threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`count_`	gt	`100`	`field:"count_" kind:gt value:"100"`
`sc_filter_result`	eq	`DENIED`	`field:"sc_filter_result" kind:eq value:"DENIED"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`StartTime`	`summarize`
`c_ip`	`summarize`
`cs_host`	`summarize`