MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Rule body
id: 9c4b1b9c-6462-41ce-8f2e-ce8c104331fc
name: OCI - Insecure metadata endpoint
description: |
'Detects insecure metadata endpoint.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: OracleCloudInfrastructureLogsConnector
dataTypes:
- OCILogs
- connectorId: OracleCloudInfraConnector
dataTypes:
- OCI_LogsV2_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1069
query: |
OCILogs
| where data_request_headers_oci_original_url_s contains '/opc/v1' or data_request_headers_oci_original_url_s contains '/openstack'
| where HttpStatusCode == 200
| extend IPCustomEntity = DstIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Stage 1: source
OCILogs
Stage 2: where
| where data_request_headers_oci_original_url_s contains '/opc/v1' or data_request_headers_oci_original_url_s contains '/openstack'
Stage 3: where
| where HttpStatusCode == 200
Stage 4: extend
| extend IPCustomEntity = DstIpAddr
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
HttpStatusCode | eq |
| field:"HttpStatusCode" kind:eq value:"200" |
data_request_headers_oci_original_url_s | contains |
| field:"data_request_headers_oci_original_url_s" kind:contains |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
IPCustomEntity | extend |