NGINX - Known malicious user agent

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

'Detects known malicious user agents'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: a10c6551-bbf2-492c-aa8a-fe6efd8c9cc1
name: NGINX - Known malicious user agent
description: |
  'Detects known malicious user agents'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - NGINX_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let mal_ua_list = dynamic(['Nikto', '(hydra)', '.nasl', 'absinthe', 'advanced email extractor', 'arachni/', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project/1.0', 'crimscanner/', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core 1.', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'user-agent:', 'vega/', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc/', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', '(BOT for JCE)']);
  NGINXHTTPServer
  | where HttpUserAgentOriginal has_any (mal_ua_list)
  | extend IPCustomEntity = SrcIpAddr, MalwareCustomEntity = HttpUserAgentOriginal
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: MalwareCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Let binding: `mal_ua_list` used in Stage 2

let mal_ua_list = dynamic(['Nikto', '(hydra)', '.nasl', 'absinthe', 'advanced email extractor', 'arachni/', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project/1.0', 'crimscanner/', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core 1.', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'user-agent:', 'vega/', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc/', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', '(BOT for JCE)']);

Stage 1: `source`

NGINXHTTPServer

Stage 2: `where`

| where HttpUserAgentOriginal has_any (mal_ua_list)

Stage 3: `extend`

| extend IPCustomEntity = SrcIpAddr, MalwareCustomEntity = HttpUserAgentOriginal

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`HttpUserAgentOriginal`	match	`(BOT for JCE)` transforms: `term` `(hydra)` transforms: `term` `.nasl` transforms: `term` `BFAC` transforms: `term` `BigCliqueBOT` transforms: `term` `FooBar/42` transforms: `term` `Nikto` transforms: `term` `SF/` transforms: `term` `ScanAlert` transforms: `term` `WPScan` transforms: `term` `Webscanner` transforms: `term` `Webster` transforms: `term` `XSpider` transforms: `term` `absinthe` transforms: `term` `advanced email extractor` transforms: `term` `arachni/` transforms: `term` `autogetcontent` transforms: `term` `bilbo` transforms: `term` `brutus` transforms: `term` `brutus/aet` transforms: `term` `bsqlbf` transforms: `term` `cgichk` transforms: `term` `cisco-torch` transforms: `term` `commix` transforms: `term` `core-project/1.0` transforms: `term` `crimscanner/` transforms: `term` `datacha0s` transforms: `term` `dirbuster` transforms: `term` `domino hunter` transforms: `term` `dotdotpwn` transforms: `term` `email extractor` transforms: `term` `fantomBrowser` transforms: `term` `fantomCrew` transforms: `term` `fhscan core 1.` transforms: `term` `floodgate` transforms: `term` `get-minimal` transforms: `term` `gootkit auto-rooter scanner` transforms: `term` `grabber` transforms: `term` `grendel-scan` transforms: `term` `havij` transforms: `term` +51 more values (see full rule source)	`field:"HttpUserAgentOriginal" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`IPCustomEntity`	`extend`
`MalwareCustomEntity`	`extend`

NGINX - Known malicious user agent

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: mal_ua_list used in Stage 2

Stage 1: source

Stage 2: where

Stage 3: extend

Indicators

Output fields

Let binding: `mal_ua_list` used in Stage 2

Stage 1: `source`

Stage 2: `where`

Stage 3: `extend`