This commit is contained in:
Shain Wray (MSTIC) 2021-02-01 12:36:51 -08:00
Родитель 9770b02cc8
Коммит f96b912bf4
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -22,7 +22,7 @@ query: |
| where TimeGenerated > ago(lookback)
| where RequestMethod == "GET"
| where RequestURL contains "&parent_request_id="
| where RequestURL matches regex @"&parent_request_id=(?:[A-Za-z0-9_\/\+\-\%]{128,1000})={0,2}[^\r\n]{0,256}"
| where RequestURL matches regex @"&parent_request_id=(?:[A-Za-z0-9_\/\+\-\%]{128,1000})={0,2}[^\r\n]{0,256}"
| extend Quality = "high"
| extend RuleName = "Backdoor.HTTP.BEACON.[Yelp GET]"
| project TimeGenerated, Quality, RuleName, DeviceVendor, DeviceProduct, TenantId, SourceIP, DestinationIP, DestinationHostName, RequestMethod, RequestURL;