Microsoft Sentinel high experimental kql

Apache - Known malicious user agent

'Detects known malicious user agents'

View Source

Detection Logic

let mal_uas = dynamic(['Metasploit', '360Spider', '404checker', 'AllSubmitter', 'BackDoorBot', 'CATExplorador', 'Nikto', 'havij']);
ApacheHTTPServer
| where HttpUserAgentOriginal has_any (mal_uas)
| extend IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...