Software

let ScannerUserAgents = dynamic([
    "Nmap", "masscan", "ZGrab", "zgrab", "nuclei", "Nikto", "sqlmap",
    "WPScan", "wpscan", "Gobuster", "gobuster", "dirbuster", "feroxbuster",
    "WhatWeb", "whatweb", "Wappalyzer", "wappalyzer", "Shodan",
    "python-requests", "Go-http-client", "libwww-perl", "curl/7",
    "HTTPie", "Wget", "Scanner", "zgrab2"
]);
let VersionProbePaths = dynamic([
    "/.git/", "/.svn/", "/.hg/",
    "/phpinfo.php", "/phpinfo",
    "/wp-login.php", "/wp-admin/", "/wp-includes/", "/readme.html", "/license.txt",
    "/CHANGELOG", "/CHANGELOG.md", "/CHANGELOG.txt",
    "/composer.json", "/package.json", "/package-lock.json",
    "/.env", "/.env.bak", "/.env.local",
    "/config.php", "/config.inc.php", "/configuration.php",
    "/server-status", "/server-info",
    "/actuator", "/actuator/env", "/actuator/info", "/actuator/health", "/actuator/mappings",
    "/api/version", "/version", "/version.txt", "/version.json",
    "/admin/version", "/api/v1/version",
    "/web.config", "/web.xml", "/WEB-INF/web.xml",
    "/crossdomain.xml", "/clientaccesspolicy.xml",
    "/jmx-console", "/manager/html", "/host-manager/html",
    "/elmah.axd", "/trace.axd",
    "/_profiler", "/symfony_profiler"
]);
union isfuzzy=true
(
    W3CIISLog
    | where TimeGenerated > ago(24h)
    | where isnotempty(cIP)
    | extend IsScanner = csUserAgent has_any (ScannerUserAgents)
    | extend IsVersionProbe = csUriStem has_any (VersionProbePaths)
    | where IsScanner or IsVersionProbe
    | project TimeGenerated, SourceIP=cIP, UserAgent=csUserAgent,
              RequestedPath=csUriStem, Method=csMethod,
              StatusCode=scStatus, BytesSent=scBytes,
              IsScanner, IsVersionProbe, Source="IIS"
),
(
    AppServiceHTTPLogs
    | where TimeGenerated > ago(24h)
    | where isnotempty(CIp)
    | extend IsScanner = UserAgent has_any (ScannerUserAgents)
    | extend IsVersionProbe = CsUriStem has_any (VersionProbePaths)
    | where IsScanner or IsVersionProbe
    | project TimeGenerated, SourceIP=CIp, UserAgent,
              RequestedPath=CsUriStem, Method=CsMethod,
              StatusCode=ScStatus, BytesSent=ScBytes,
              IsScanner, IsVersionProbe, Source="AppService"
),
(
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceEventCategory in ("Web Attack", "Scan", "Reconnaissance", "Policy")
          or Activity has_any ("scan", "probe", "fingerprint", "enumerat")
    | where RequestURL has_any (VersionProbePaths)
          or SourceUserName has_any (ScannerUserAgents)
          or RequestClientApplication has_any (ScannerUserAgents)
    | extend IsScanner = RequestClientApplication has_any (ScannerUserAgents)
    | extend IsVersionProbe = RequestURL has_any (VersionProbePaths)
    | project TimeGenerated, SourceIP, UserAgent=RequestClientApplication,
              RequestedPath=RequestURL, Method=RequestMethod,
              StatusCode=EventOutcome,
              IsScanner, IsVersionProbe, Source=DeviceVendor
)
| summarize
    RequestCount = count(),
    UniquePaths = dcount(RequestedPath),
    Paths = make_set(RequestedPath, 30),
    StatusCodes = make_set(StatusCode),
    Methods = make_set(Method),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, UserAgent, IsScanner, IsVersionProbe, Source
| where RequestCount > 5 or UniquePaths > 3
| extend ScannerScore = toint(IsScanner) + iff(UniquePaths > 10, 2, iff(UniquePaths > 5, 1, 0))
| sort by ScannerScore desc, RequestCount desc

index=web (sourcetype=access_combined OR sourcetype=access_combined_wcookie OR sourcetype=iis OR sourcetype="ms:iis:auto")
| eval user_agent=coalesce(http_user_agent, useragent, cs_User_Agent, "-")
| eval uri=coalesce(uri_path, cs_uri_stem, uri, "-")
| eval src=coalesce(src_ip, clientip, c_ip, "-")
| eval http_method=coalesce(http_method, method, cs_method, "-")
| eval status_code=coalesce(status, sc_status, "-")
```

inner_eval:
```
| eval ua_lower=lower(user_agent)
| eval uri_lower=lower(uri)
| eval is_scanner=if(
    match(ua_lower, "(nmap|masscan|zgrab|nuclei|nikto|sqlmap|wpscan|gobuster|dirbuster|feroxbuster|whatweb|wappalyzer|shodan|python-requests|go-http-client|libwww-perl|httipe|scanner|zgrab2)"),
    1, 0)
| eval is_version_probe=if(
    match(uri_lower, "(/\.git/|/\.svn/|/\.hg/|/phpinfo|/wp-login|/wp-admin/|/wp-includes/|/readme\.html|/license\.txt|/changelog|/composer\.json|/package\.json|/\.env|/config\.php|/server-status|/server-info|/actuator|/api/version|/version\.txt|/version\.json|/web\.config|/web\.xml|/jmx-console|/manager/html|/_profiler)"),
    1, 0)
| where is_scanner=1 OR is_version_probe=1
| stats
    count as RequestCount,
    dc(uri) as UniquePaths,
    values(uri) as Paths,
    values(status_code) as StatusCodes,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen,
    max(is_scanner) as HasScannerUA,
    max(is_version_probe) as HasVersionProbe
    by src, user_agent
| where RequestCount > 5 OR UniquePaths > 3
| eval ScannerScore=HasScannerUA + if(UniquePaths > 10, 2, if(UniquePaths > 5, 1, 0))
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S")
| eval LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table src, user_agent, RequestCount, UniquePaths, Paths, StatusCodes, HasScannerUA, HasVersionProbe, ScannerScore, FirstSeen, LastSeen
| sort - ScannerScore, - RequestCount

// T1592.002 — Software Fingerprinting
any where event.dataset : ("iis.access", "apache_http_server.access")
  and (user_agent.original : ("Nmap*", "masscan*", "zgrab*", "nuclei*", "nikto*",
    "WPScan*", "whatweb*", "Wappalyzer*", "python-requests*", "Go-http-client*")
  or url.path : ("/.git/*", "/phpinfo.php", "/wp-login.php", "/wp-admin/*",
    "/actuator/*", "/api/version", "/.env", "/server-status", "/CHANGELOG*"))

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("useragent") ILIKE '%nmap%' OR LOWER("useragent") ILIKE '%nuclei%' OR LOWER("useragent") ILIKE '%wpscan%' OR LOWER("requesturl") ILIKE '%wp-login%' OR LOWER("requesturl") ILIKE '%phpinfo%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("useragent") ILIKE '%nmap%' OR LOWER("useragent") ILIKE '%nuclei%' OR LOWER("useragent") ILIKE '%wpscan%' OR LOWER("requesturl") ILIKE '%wp-login%' OR LOWER("requesturl") ILIKE '%phpinfo%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

_sourceCategory=*firewall* OR _sourceCategory=*network*
| json auto
| where !(src_ip matches "10.*") and !(src_ip matches "192.168.*")
| count by src_ip, dest_ip, dest_port
| sort by _count desc

rule t1592_002_software {
  meta:
    author = "df00tech"
    description = "Detects Software (T1592.002)"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1592.002"
    confidence = "medium"
    severity = "low"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.principal.ip != ""
  condition:
    $e
}

#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1592.002 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])