detection.wiki

Detection rules › Kusto

Oracle - Malicious user agent

Status
available
Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detects known malicious user agent strings'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 51d050ee-5740-11ec-bf63-0242ac130002
name: Oracle - Malicious user agent
description: |
  'Detects known malicious user agent strings'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - OracleWebLogicServer_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  OracleWebLogicServerEvent
  | where isnotempty(HttpUserAgentOriginal)
  | where HttpUserAgentOriginal has_any ('Nikto', '(hydra)', '.nasl', 'absinthe', 'advanced email extractor', 'arachni/', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project/1.0', 'crimscanner/', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core 1.', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'user-agent:', 'vega/', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc/', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', '(BOT for JCE)')
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: source

OracleWebLogicServerEvent

Stage 2: where

| where isnotempty(HttpUserAgentOriginal)

Stage 3: where

| where HttpUserAgentOriginal has_any ('Nikto', '(hydra)', '.nasl', 'absinthe', 'advanced email extractor', 'arachni/', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project/1.0', 'crimscanner/', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core 1.', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'user-agent:', 'vega/', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc/', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', '(BOT for JCE)')

Stage 4: extend

| extend IPCustomEntity = SrcIpAddr

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
HttpUserAgentOriginalis_not_null
  • (no value, null check)
field:"HttpUserAgentOriginal" kind:is_not_null
HttpUserAgentOriginalmatch
  • (BOT for JCE) transforms: term
  • (hydra) transforms: term
  • .nasl transforms: term
  • BFAC transforms: term
  • BigCliqueBOT transforms: term
  • FooBar/42 transforms: term
  • Nikto transforms: term
  • SF/ transforms: term
  • ScanAlert transforms: term
  • WPScan transforms: term
  • Webscanner transforms: term
  • Webster transforms: term
  • XSpider transforms: term
  • absinthe transforms: term
  • advanced email extractor transforms: term
  • arachni/ transforms: term
  • autogetcontent transforms: term
  • bilbo transforms: term
  • brutus transforms: term
  • brutus/aet transforms: term
  • bsqlbf transforms: term
  • cgichk transforms: term
  • cisco-torch transforms: term
  • commix transforms: term
  • core-project/1.0 transforms: term
  • crimscanner/ transforms: term
  • datacha0s transforms: term
  • dirbuster transforms: term
  • domino hunter transforms: term
  • dotdotpwn transforms: term
  • email extractor transforms: term
  • fantomBrowser transforms: term
  • fantomCrew transforms: term
  • fhscan core 1. transforms: term
  • floodgate transforms: term
  • get-minimal transforms: term
  • gootkit auto-rooter scanner transforms: term
  • grabber transforms: term
  • grendel-scan transforms: term
  • havij transforms: term
  • +51 more values (see full rule source)
field:"HttpUserAgentOriginal" kind:match

Output fields

These fields are emitted when the rule matches.

FieldSource
IPCustomEntityextend