FalconForce unknown stable kql

ADCS Certificate Requested via Web Interface

This query uses IIS logs to identify certificates requested via the web interface. In the first step, ADCS servers are listed by looking for an ADCS specific Uri Stem in the IIS logs events. A hard-coded ADCS server list can also be provided as environment variable instead (adcsserverlist). In a second step, requests to these servers done via the web interface are identified by looking for POST to a '/certsrv/certfnsh.asp' Uri.

View Source

Detection Logic

let timeframe = 2*1h;
let RuleId = "0294";
let DedupFields = dynamic(["TimeGenerated"]);
// List ADCS servers.
let ADCSsrv = dynamic(["ADCS01.test.lab", "ADCS02.test.lab"]);
// Cert request via web interface.
W3CIISLog
| where ingestion_time() >= ago(timeframe)
| where Computer in~ (ADCSsrv)
| where not(csMethod in~ ("GET","HEAD"))
| where csUriStem =~ "/certsrv/certfnsh.asp"
| extend HostName=tostring(split(Computer,".")[0]),DnsDomain=iif(Computer contains ".", substring(Computer, indexof(Computer, ".") + 1, strlen(Computer)),"")
// Begin environment-specific filter.
// End environment-specific filter.
// Begin de-duplication logic.
| extend DedupFieldValues=pack_all()
| mv-apply e=DedupFields to typeof(string) on (
    extend DedupValue=DedupFieldValues[tostring(e)]
| order by e // Sorting is required to ensure make_list is deterministic.
| summarize DedupValues=make_list(DedupValue)
)
| extend DedupEntity=strcat_array(DedupValues, "
| ")
| project-away DedupFieldValues, DedupValues
| join kind=leftanti (
    SecurityAlert
| where AlertName has RuleId and ProviderName has "ASI"
| where TimeGenerated >= ago(timeframe)
| extend DedupEntity = tostring(parse_json(tostring(parse_json(ExtendedProperties)["Custom Details"])).DedupEntity[0])
| project DedupEntity
) on DedupEntity
// End de-duplication logic.

Field Validations

Loading…

Comments (0)

Loading comments...