Imperva - Malicious user agent

Status: available
Severity: high
Time window: 5m
Group by: SrcIpAddr
Source: github.com/Azure/Azure-Sentinel

'Detects requests containing known malicious user agent strings.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: 905794a9-bc46-42b9-974d-5a2dd58110c5
name: Imperva - Malicious user agent
description: |
  'Detects requests containing known malicious user agent strings.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ImpervaWAFCloudAPI
    dataTypes:
      - ImpervaWAFCloud
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  ImpervaWAFCloud
  | where HttpUserAgentOriginal has_any ('Nikto', 'hydra', 'advanced email extractor', 'BFAC', 'brutus', 'cgichk', 'cisco-torch', 'scanner', 'datacha0s', 'dirbuster', 'grabber', 'havij', 'internet ninja', 'masscan', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'qualys was', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webvulnscan', 'xmlrpc exploit', 'WPScan', 'XSpider', 'Webster', 'fantomCrew', 'fantomBrowser')
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ImpervaWAFCloud

Stage 2: `where`

| where HttpUserAgentOriginal has_any ('Nikto', 'hydra', 'advanced email extractor', 'BFAC', 'brutus', 'cgichk', 'cisco-torch', 'scanner', 'datacha0s', 'dirbuster', 'grabber', 'havij', 'internet ninja', 'masscan', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'qualys was', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webvulnscan', 'xmlrpc exploit', 'WPScan', 'XSpider', 'Webster', 'fantomCrew', 'fantomBrowser')

Stage 3: `summarize`

| summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)

Stage 4: `extend`

| extend IPCustomEntity = SrcIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`HttpUserAgentOriginal`	match	`BFAC` transforms: `term` `Nikto` transforms: `term` `WPScan` transforms: `term` `Webster` transforms: `term` `XSpider` transforms: `term` `advanced email extractor` transforms: `term` `brutus` transforms: `term` `cgichk` transforms: `term` `cisco-torch` transforms: `term` `datacha0s` transforms: `term` `dirbuster` transforms: `term` `fantomBrowser` transforms: `term` `fantomCrew` transforms: `term` `grabber` transforms: `term` `havij` transforms: `term` `hydra` transforms: `term` `internet ninja` transforms: `term` `masscan` transforms: `term` `morfeus` transforms: `term` `mysqloit` transforms: `term` `n-stealth` transforms: `term` `nessus` transforms: `term` `netsparker` transforms: `term` `nmap nse` transforms: `term` `nmap scripting engine` transforms: `term` `nmap-nse` transforms: `term` `nsauditor` transforms: `term` `openvas` transforms: `term` `pangolin` transforms: `term` `qualys was` transforms: `term` `scanner` transforms: `term` `security scan` transforms: `term` `springenwerk` transforms: `term` `sql power injector` transforms: `term` `sqlmap` transforms: `term` `sqlninja` transforms: `term` `w3af.org` transforms: `term` `w3af.sf.net` transforms: `term` `w3af.sourceforge.net` transforms: `term` `webbandit` transforms: `term` `webinspect` transforms: `term` `webvulnscan` transforms: `term` `xmlrpc exploit` transforms: `term`	`field:"HttpUserAgentOriginal" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`SrcIpAddr`	`summarize`
`IPCustomEntity`	`extend`

Imperva - Malicious user agent

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `summarize`

Stage 4: `extend`