External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets

// THREAT-Recon-ExternalVulnScannerBurstDetection
// External source sweeping many unique URIs/params/ports against internet-facing assets in a short window
let Lookback = 1h;
let UniqueUriThreshold = 40;
let RequestCountThreshold = 150;
let BurstWindowMinutes = 10;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceAction !in ("allow") or isnotempty(RequestURL)
| where isnotempty(SourceIP) and isnotempty(RequestURL)
| extend UriPath = tostring(split(RequestURL, "?")[0])
| extend QueryParams = tostring(split(RequestURL, "?")[1])
| summarize
    RequestCount = count(),
    UniqueUris = dcount(UriPath),
    UniqueParams = dcount(QueryParams),
    UniqueDestPorts = dcount(DestinationPort),
    UniqueDestHosts = dcount(DestinationHostName),
    StatusCodes = make_set(tostring(DeviceCustomNumber1), 10),
    SampleUris = make_set(UriPath, 15),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, bin(TimeGenerated, BurstWindowMinutes * 1m)
| where UniqueUris >= UniqueUriThreshold or RequestCount >= RequestCountThreshold
| extend DurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend RequestsPerMinute = round(RequestCount * 1.0 / iff(DurationMinutes == 0, 1, DurationMinutes), 1)
| project FirstSeen, LastSeen, DurationMinutes, SourceIP, RequestCount, UniqueUris, UniqueParams,
          UniqueDestPorts, UniqueDestHosts, RequestsPerMinute, StatusCodes, SampleUris
| sort by RequestCount desc

index=waf OR index=firewall OR index=proxy earliest=-1h
| eval uri_path=coalesce(uri_path, mvindex(split(url, "?"), 0), cs_uri_stem)
| eval src_display=coalesce(src_ip, src, clientip, c_ip)
| eval dest_port=coalesce(dest_port, cs_uri_port, 0)
| bin _time span=10m
| stats
    count as request_count,
    dc(uri_path) as unique_uris,
    dc(dest_port) as unique_dest_ports,
    dc(dest) as unique_dest_hosts,
    values(status) as status_codes,
    values(uri_path) as sample_uris,
    min(_time) as first_seen,
    max(_time) as last_seen
    by src_display, _time
| where unique_uris >= 40 OR request_count >= 150
| eval duration_minutes=round((last_seen - first_seen) / 60, 1)
| eval requests_per_minute=round(request_count / (if(duration_minutes=0, 1, duration_minutes)), 1)
| table first_seen, last_seen, duration_minutes, src_display, request_count, unique_uris,
         unique_dest_ports, unique_dest_hosts, requests_per_minute, status_codes, sample_uris
| sort - request_count

sequence by source.ip with maxspan=10m
  [network where event.dataset : "waf.log" and url.path != null]
  [network where event.dataset : "waf.log" and url.path != null]
until [network where false]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    UTF8(sourceip) AS SourceIP,
    COUNT(*) AS RequestCount,
    UNIQUECOUNT("URL") AS UniqueUris,
    UNIQUECOUNT(destinationport) AS UniqueDestPorts
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Universal LEEF', 'L7 Firewalls', 'Web Application Firewall')
  AND "URL" IS NOT NULL
  AND starttime > NOW() - 3600000
GROUP BY SourceIP
HAVING UNIQUECOUNT("URL") >= 40 OR COUNT(*) >= 150
ORDER BY RequestCount DESC
LIMIT 1000

_sourceCategory=*waf* OR _sourceCategory=*firewall* OR _sourceCategory=*proxy*
| json field=_raw "src_ip", "url", "status", "dest_port" as src_ip, url, status, dest_port
| parse regex field=url "(?<uri_path>[^\?]+)"
| timeslice 10m
| stats count as request_count, count_distinct(uri_path) as unique_uris, count_distinct(dest_port) as unique_dest_ports by src_ip, _timeslice
| where unique_uris >= 40 or request_count >= 150
| sort - request_count

rule external_vuln_scanner_burst {
  meta:
    author = "df00tech"
    description = "Detects external burst/sweep vulnerability scanning against internet-facing assets"
    severity = "MEDIUM"
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1595.002"
    reference = "https://attack.mitre.org/techniques/T1595/002/"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url != ""
    $e.principal.ip = $src_ip

  match:
    $src_ip over 10m

  outcome:
    $request_count = count($e.metadata.id)
    $unique_uris = count_distinct($e.target.url)

  condition:
    $e and $unique_uris >= 40
}

#event_simpleName=NetworkHttpRequest OR #event_simpleName=WafBlockEvent
| bucket(span=10m)
| groupBy([ClientIP, _bucket], function=([count(as=RequestCount), distinct_count(field=UriPath, as=UniqueUris), distinct_count(field=DestinationPort, as=UniqueDestPorts)]))
| test(UniqueUris >= 40 OR RequestCount >= 150)
| sort(field=RequestCount, order=desc)