Wordlist Scanning

let ScannerUserAgents = dynamic([
    "gobuster", "DirBuster", "dirbuster", "feroxbuster", "ffuf",
    "wfuzz", "nikto", "dirsearch", "nuclei", "wapiti", "skipfish",
    "s3recon", "GCPBucketBrute", "dirfuzz", "dirb/", "sqlmap",
    "w3af", "whatweb", "commix", "nmap scripting"
]);
// Branch 1: Known scanning tool User-Agent strings in IIS web server logs
let UADetection = W3CIISLog
| where TimeGenerated > ago(24h)
| where csUserAgent has_any (ScannerUserAgents)
| summarize
    RequestCount = count(),
    UniqueUris = dcount(csUriStem),
    Errors404 = countif(scStatus == 404),
    Errors403 = countif(scStatus == 403),
    SamplePaths = make_set(csUriStem, 15),
    FirstRequest = min(TimeGenerated),
    LastRequest = max(TimeGenerated)
  by cIP, csHost, csUserAgent, sSiteName
| extend ScanDurationMinutes = datetime_diff('minute', LastRequest, FirstRequest)
| extend DetectionType = "KnownScannerUserAgent", SuspicionScore = 3
| project FirstRequest, LastRequest, cIP, csHost, csUserAgent, RequestCount, UniqueUris,
          Errors404, Errors403, SamplePaths, ScanDurationMinutes, DetectionType, SuspicionScore;
// Branch 2: High-volume 404/403 responses from single source IP (wordlist enumeration pattern)
let VolumeDetection = W3CIISLog
| where TimeGenerated > ago(24h)
| where scStatus in (404, 403)
| summarize
    RequestCount = count(),
    UniqueUris = dcount(csUriStem),
    Errors404 = countif(scStatus == 404),
    Errors403 = countif(scStatus == 403),
    SamplePaths = make_set(csUriStem, 15),
    FirstRequest = min(TimeGenerated),
    LastRequest = max(TimeGenerated)
  by cIP, csHost, sSiteName, HourBin = bin(TimeGenerated, 1h)
| where RequestCount > 200 and UniqueUris > 100
| extend ScanDurationMinutes = 60, csUserAgent = "Unknown/Multiple"
| extend DetectionType = "HighVolume404Pattern", SuspicionScore = 2
| project FirstRequest, LastRequest, cIP, csHost, csUserAgent, RequestCount, UniqueUris,
          Errors404, Errors403, SamplePaths, ScanDurationMinutes, DetectionType, SuspicionScore;
union UADetection, VolumeDetection
| sort by FirstRequest desc

index=web sourcetype=access_combined
| eval scanner_ua=if(match(lower(useragent), "gobuster|dirbuster|feroxbuster|ffuf|wfuzz|nikto|dirsearch|nuclei|wapiti|skipfish|sqlmap|s3recon|gcpbucketbrute|dirb/|w3af|commix"), 1, 0)
| eval is_error=if(status=="404" OR status=="403", 1, 0)
| stats
    count as total_requests,
    sum(scanner_ua) as scanner_ua_requests,
    sum(is_error) as error_requests,
    dc(uri) as unique_uris,
    first(useragent) as primary_ua,
    min(_time) as first_seen,
    max(_time) as last_seen
  by clientip, host
| eval scan_duration_minutes=round((last_seen - first_seen) / 60, 1)
| eval detection_type=case(
    scanner_ua_requests > 0 AND error_requests > 50, "KnownScanner_HighErrorVolume",
    scanner_ua_requests > 0, "KnownScannerUserAgent",
    error_requests > 200 AND unique_uris > 100, "HighVolume404Pattern",
    1=1, null()
)
| where isnotnull(detection_type)
| eval suspicion_score=case(
    scanner_ua_requests > 0 AND error_requests > 100, 4,
    scanner_ua_requests > 0, 3,
    error_requests > 500 AND unique_uris > 250, 3,
    error_requests > 200 AND unique_uris > 100, 2,
    1=1, 1
)
| table first_seen, last_seen, clientip, host, primary_ua, total_requests, unique_uris, error_requests, scan_duration_minutes, detection_type, suspicion_score
| sort - suspicion_score - first_seen

// T1595.003 — Wordlist Scanning
any where event.dataset : ("iis.access", "apache_http_server.access")
  and user_agent.original : (
    "gobuster*", "DirBuster*", "feroxbuster*", "ffuf*", "wfuzz*",
    "nikto*", "dirsearch*", "nuclei*", "dirb/*"
  )
  and http.response.status_code == 404

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("useragent") ILIKE '%gobuster%' OR LOWER("useragent") ILIKE '%dirbuster%' OR LOWER("useragent") ILIKE '%feroxbuster%' OR LOWER("useragent") ILIKE '%ffuf%' AND "responsecode" = '404' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("useragent") ILIKE '%gobuster%' OR LOWER("useragent") ILIKE '%dirbuster%' OR LOWER("useragent") ILIKE '%feroxbuster%' OR LOWER("useragent") ILIKE '%ffuf%' AND "responsecode" = '404')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*iis* OR _sourceCategory=*apache*
| parse regex "(?<client_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}) - (?<user>[^ ]+) .* \"(?<method>[A-Z]+) (?<uri>[^ ]+).*\" (?<status>\\d+)"
| count by client_ip, uri
| sort by _count desc

rule t1595_003_wordlist_scanning {
  meta:
    author = "df00tech"
    description = "Detects Wordlist Scanning (T1595.003)"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1595.003"
    confidence = "medium"
    severity = "medium"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.principal.ip != ""
  condition:
    $e
}

#event_simpleName = "ProcessRollup2"
| ImageFileName = /python|curl|wget|nmap|masscan/i
| TechniqueLabel := "T1595.003 - Reconnaissance"
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, TechniqueLabel])