missed one
This commit is contained in:
Родитель
9770b02cc8
Коммит
f96b912bf4
|
@ -22,7 +22,7 @@ query: |
|
|||
| where TimeGenerated > ago(lookback)
|
||||
| where RequestMethod == "GET"
|
||||
| where RequestURL contains "&parent_request_id="
|
||||
| where RequestURL matches regex @"&parent_request_id=(?:[A-Za-z0-9_\/\+\-\%]{128,1000})={0,2}[^\r\n]{0,256}"
|
||||
| where RequestURL matches regex @"&parent_request_id=(?:[A-Za-z0-9_\/\+\-\%]{128,1000})={0,2}[^\r\n]{0,256}"
|
||||
| extend Quality = "high"
|
||||
| extend RuleName = "Backdoor.HTTP.BEACON.[Yelp GET]"
|
||||
| project TimeGenerated, Quality, RuleName, DeviceVendor, DeviceProduct, TenantId, SourceIP, DestinationIP, DestinationHostName, RequestMethod, RequestURL;
|
||||
|
|
Загрузка…
Ссылка в новой задаче