URI requests from single client

id: a787a819-40df-4c9f-a5ae-850d5a2a0cf6
name: URI requests from single client
description: |
  'This finds connections to server files requested by only one client. Effective when actor uses static operational IP addresses. Threshold can be modified. Larger execution window increases reliability of results.'
description_detailed: |
  'This will look for connections to files on the server that are requested by only a single client. 
  This analytic will be effective where an actor is utilising relatively static operational IP addresses. The threshold can be modified. 
  The larger the execution window for this query the more reliable the results returned.'
severity: Low
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |


  let clientThreshold = 1;
  let scriptExtensions = dynamic([".php", ".aspx", ".asp", ".cfml"]);
  let data = W3CIISLog
  | where csUriStem has_any(scriptExtensions)
  // find sucessfull connection 
  |where scStatus == 200
  //Exclude local addresses, needs editing to match your network configuration using ipv4_is_private operator
  |where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
  // excluded internal web page 
  |where ipv4_is_private(sIP) == false   
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), makelist(cIP), dcount(TimeGenerated) by csUriStem, sSiteName, csUserAgent;
  data
  | mvexpand list_cIP
  | distinct StartTime, EndTime, tostring(list_cIP), csUriStem, sSiteName, csUserAgent
  | summarize StartTime = min(StartTime), EndTime = max(StartTime), dcount(list_cIP), makelist(list_cIP), makelist(sSiteName) by csUriStem, csUserAgent
  | where dcount_list_cIP == clientThreshold 
  //Selects user agent strings that are probably browsers, comment out to see all
  | where csUserAgent startswith "Mozilla"
  | extend timestamp = StartTime, UserAgentCustomEntity = csUserAgent
entityMappings:
  - entityType: CloudLogonSession
    fieldMappings:
      - identifier: UserAgent
        columnName: csUserAgent
version: 1.0.2
metadata:
    source:
        kind: Community
    author:
        name: Thomas McElroy
    support:
        tier: Community
    categories:
        domains: [ "Security - Other" ]