Query: Sigma rule for Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling
Matching passage: Sigma rule: Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling. Logsource: azure / auditlogs. Rule: title: Application URI Configuration Changes id: 0055ad1f-be85-4798-83cf-a6da17c993b3 status: test description: 'Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.stealth - attack.t1528 - attack.t1078.004 - attack.persistence - attack.credential-access - attack.privilege-escalation logsource: product: azure service: auditlogs detection: selection: properties.message: Update Application Sucess- Property Name AppAddress condition: selection falsepositives: - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event. level: high
Near-miss passage: Sigma rule: Detects potential SQL injection attempts via GET requests in access logs.. Logsource: webserver. Rule: title: SQL Injection Strings In URI id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453 status: test description: Detects potential SQL injection attempts via GET requests in access logs. references: - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/ - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/ - https://brightsec.com/blog/sql-injection-payloads/ - https://github.com/payloadbox/sql-injection-payload-list - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) date: 2020-02-22 modified: 2023-09-04 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: GET keywords: - '@@version' - '%271%27%3D%271' - '=select ' - =select( - =select%20 - concat_ws( - CONCAT(0x - from mysql.innodb_table_stats - from%20mysql.innodb_table_stats - group_concat( - information_schema.tables - json_arrayagg( - or 1=1# - or%201=1# - 'order by ' - order%20by%20 - 'select * ' - select database() - select version() - select%20*%20 - select%20database() - select%20version() - select%28sleep%2810%29 - SELECTCHAR( - table_schema - UNION ALL SELECT - UNION SELECT - UNION%20ALL%20SELECT - UNION%20SELECT - '''1''=''1' filter_main_status: sc-status: 404 condition: selection and keywords and not 1 of filter_main_* falsepositives: - Java scripts and CSS Files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high