detection.wiki

Detection rules › Kusto

ApexOne - Commands in Url

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects commands in Url.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 4a9a5900-67b7-11ec-90d6-0242ac120003
name: ApexOne - Commands in Url
description: |
  'Detects commands in Url.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  TMApexOneEvent
  | where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106") 
  | where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f' 
  | extend UrlCustomEntity = UrlOriginal
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: UrlCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: source

TMApexOneEvent

Stage 2: where

| where EventSubType in ("WB:7", "CnC:Block", "VAD", "700106")

Stage 3: where

| where UrlOriginal contains 'cat%20/etc/passwd' or UrlOriginal contains '/etc/passwd' or UrlOriginal contains 'ping -i' or UrlOriginal contains '/usr/bin/id(' or UrlOriginal contains '%2f%75%73%72%2f%62%69%6e%2f%69%64' or UrlOriginal contains 'phpinfo()' or UrlOriginal contains '%70%68%70%69%6e%66%6f%28%29' or UrlOriginal contains ';id' or UrlOriginal contains '%3b%69%64' or UrlOriginal contains '/bin/bash -c' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27' or UrlOriginal contains '/bin/bash' or UrlOriginal contains '%2f%62%69%6e%2f%62%61%73%68' or UrlOriginal contains 'sleep(' or UrlOriginal contains '%73%6c%65%65%70%28' or UrlOriginal contains 'curl' or UrlOriginal contains '%63%75%72%6c' or UrlOriginal contains '&dir' or UrlOriginal contains '%26%64%69%72' or UrlOriginal contains '& dir' or UrlOriginal =~ '%26%20%64%69%72' or UrlOriginal contains '<script>' or UrlOriginal  contains '%3c%73%63%72%69%70%74%3e' or UrlOriginal contains 'eval(' or UrlOriginal contains '%65%76%61%6c%28' or UrlOriginal contains 'exec(' or UrlOriginal contains '%65%78%65%63%28' or UrlOriginal contains 'whoami' or UrlOriginal contains '%77%68%6f%61%6d%69' or UrlOriginal contains 'wget' or UrlOriginal contains 'python' or UrlOriginal contains 'gcc' or UrlOriginal contains 'uname' or UrlOriginal contains 'systeminfo' or UrlOriginal contains '%77%67%65%74' or UrlOriginal contains '%70%79%74%68%6f%6e' or UrlOriginal contains '%75%6e%61%6d%65' or UrlOriginal =~ '%73%79%73%74%65%6d%69%6e%66%6f'

Stage 4: extend

| extend UrlCustomEntity = UrlOriginal

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventSubTypein
  • 700106
  • CnC:Block
  • VAD
  • WB:7
field:"EventSubType" kind:in
UrlOriginalcontains
  • %26%64%69%72
  • %2f%62%69%6e%2f%62%61%73%68
  • %2f%62%69%6e%2f%62%61%73%68%20%2d%63%27
  • %2f%75%73%72%2f%62%69%6e%2f%69%64
  • %3b%69%64
  • %3c%73%63%72%69%70%74%3e
  • %63%75%72%6c
  • %65%76%61%6c%28
  • %65%78%65%63%28
  • %70%68%70%69%6e%66%6f%28%29
  • %70%79%74%68%6f%6e
  • %73%6c%65%65%70%28
  • %75%6e%61%6d%65
  • %77%67%65%74
  • %77%68%6f%61%6d%69
  • & dir
  • &dir
  • /bin/bash
  • /bin/bash -c
  • /etc/passwd
  • /usr/bin/id(
  • ;id
  • <script>
  • cat%20/etc/passwd
  • curl
  • eval(
  • exec(
  • gcc
  • phpinfo()
  • ping -i
  • python
  • sleep(
  • systeminfo
  • uname
  • wget
  • whoami
field:"UrlOriginal" kind:contains
UrlOriginaleq
  • %26%20%64%69%72
  • %73%79%73%74%65%6d%69%6e%66%6f
field:"UrlOriginal" kind:eq

Output fields

These fields are emitted when the rule matches.

FieldSource
UrlCustomEntityextend