Tomcat - Known malicious user agent

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects known malicious user agents'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: 5e77a818-5825-4ff6-a901-80891c4774d1
name: Tomcat - Known malicious user agent
description: |
  'Detects known malicious user agents'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    datatypes:
      - Tomcat_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let malicious_ua = dynamic(['Nikto', 'hydra', '.nasl', 'absinthe', 'advanced email extractor', 'arachni', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project', 'crimscanner', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'vega', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', 'BOT for JCE']);
  TomcatEvent
  | where HttpUserAgentOriginal has_any (malicious_ua)
  | extend MalwareCustomEntity = HttpUserAgentOriginal
entityMappings:
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: MalwareCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: `malicious_ua` used in Stage 2

let malicious_ua = dynamic(['Nikto', 'hydra', '.nasl', 'absinthe', 'advanced email extractor', 'arachni', 'autogetcontent', 'bilbo', 'BFAC', 'brutus', 'brutus/aet', 'bsqlbf', 'cgichk', 'cisco-torch', 'commix', 'core-project', 'crimscanner', 'datacha0s', 'dirbuster', 'domino hunter', 'dotdotpwn', 'email extractor', 'fhscan core', 'floodgate', 'get-minimal', 'gootkit auto-rooter scanner', 'grabber', 'grendel-scan', 'havij', 'inspath', 'internet ninja', 'jaascois', 'zmeu', 'masscan', 'metis', 'morfeus', 'mysqloit', 'n-stealth', 'nessus', 'netsparker', 'nmap nse', 'nmap scripting engine', 'nmap-nse', 'nsauditor', 'openvas', 'pangolin', 'paros', 'pmafind', 'prog.customcrawler', 'qualys was', 's.t.a.l.k.e.r.', 'security scan', 'springenwerk', 'sql power injector', 'sqlmap', 'sqlninja', 'teh forest lobster', 'this is an exploit', 'toata dragostea', 'toata dragostea mea pentru diavola', 'uil2pn', 'vega', 'voideye', 'w3af.sf.net', 'w3af.sourceforge.net', 'w3af.org', 'webbandit', 'webinspect', 'webshag', 'webtrends security analyzer', 'webvulnscan', 'whatweb', 'whcc', 'wordpress hash grabber', 'xmlrpc exploit', 'WPScan', 'XSpider', 'SF/', 'FooBar/42', 'ScanAlert', 'Webscanner', 'Webster', 'fantomCrew', 'fantomBrowser', 'visvo', 'magereport', 'ltx71', 'websiteprotection', 'BigCliqueBOT', 'BOT for JCE']);

Stage 1: `source`

TomcatEvent

Stage 2: `where`

| where HttpUserAgentOriginal has_any (malicious_ua)

Stage 3: `extend`

| extend MalwareCustomEntity = HttpUserAgentOriginal

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`HttpUserAgentOriginal`	match	`.nasl` transforms: `term` `BFAC` transforms: `term` `BOT for JCE` transforms: `term` `BigCliqueBOT` transforms: `term` `FooBar/42` transforms: `term` `Nikto` transforms: `term` `SF/` transforms: `term` `ScanAlert` transforms: `term` `WPScan` transforms: `term` `Webscanner` transforms: `term` `Webster` transforms: `term` `XSpider` transforms: `term` `absinthe` transforms: `term` `advanced email extractor` transforms: `term` `arachni` transforms: `term` `autogetcontent` transforms: `term` `bilbo` transforms: `term` `brutus` transforms: `term` `brutus/aet` transforms: `term` `bsqlbf` transforms: `term` `cgichk` transforms: `term` `cisco-torch` transforms: `term` `commix` transforms: `term` `core-project` transforms: `term` `crimscanner` transforms: `term` `datacha0s` transforms: `term` `dirbuster` transforms: `term` `domino hunter` transforms: `term` `dotdotpwn` transforms: `term` `email extractor` transforms: `term` `fantomBrowser` transforms: `term` `fantomCrew` transforms: `term` `fhscan core` transforms: `term` `floodgate` transforms: `term` `get-minimal` transforms: `term` `gootkit auto-rooter scanner` transforms: `term` `grabber` transforms: `term` `grendel-scan` transforms: `term` `havij` transforms: `term` `hydra` transforms: `term` +50 more values (see full rule source)	`field:"HttpUserAgentOriginal" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`MalwareCustomEntity`	`extend`

Tomcat - Known malicious user agent

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: malicious_ua used in Stage 2

Stage 1: source

Stage 2: where

Stage 3: extend

Indicators

Output fields

Let binding: `malicious_ua` used in Stage 2

Stage 1: `source`

Stage 2: `where`

Stage 3: `extend`