Same IP address with multiple csUserAgent

id: 4edbb420-2df7-4089-9906-c335f065803e
name: Same IP address with multiple csUserAgent
description: |
  'This alerts when a client IP connects with 1-15 different useragents in less than 1 hour. Limited to 50 or less connections to avoid high traffic. May indicate malicious activity as a probing method.'
description_detailed: |
  'This alerts when the same client IP (cIP) is connecting with more than 1 but less than 15 different useragent string (csUserAgent) in less than 1 hour.
  We limit to 50 or less connections to avoid high traffic sites. This may indicate malicious activity as this is a method of probing an environment
  References: Status code mappings for your convenience
  IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
  Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |

  W3CIISLog
  | where scStatus !startswith "20" and scStatus !startswith "30" and cIP !startswith "192.168." and cIP != sIP and cIP != "::1"
  //Exclude local addresses, using ipv4_is_private operator
  |where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), makeset(csUserAgent), ConnectionCount = count() 
  by Computer, sSiteName, sIP, sPort, cIP, csMethod
  | extend csUserAgentPerIPCount = arraylength(set_csUserAgent)
  | where  csUserAgentPerIPCount between ( 2 .. 15 ) and ConnectionCount <=50
  | extend timestamp = StartTime, IPCustomEntity = cIP, HostCustomEntity = Computer
version: 1.0.1
metadata:
    source:
        kind: Community
    author:
        name: Shain
    support:
        tier: Community
    categories:
        domains: [ "Security - Network" ]