Microsoft Sentinel high experimental kql

Imperva - Malicious Client

'Detects connections from known malicious clients.'

View Source

Detection Logic

ImpervaWAFCloud
| where ClientApp in~ ('VulnerabilityScanner', 'DDoSBot', 'ClickBot','CommentSpamBot','HackingTool', 'SpamBot', 'Worm')
| where DvcAction !startswith 'REQ_BLOCKED' or DvcAction !startswith 'REQ_BAD_'
| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = QueryString

Field Validations

Loading…

Comments (0)

Loading comments...