KQL Search

Query Details

APIM AI Gateway - Potential API enumeration or scanning

APIM Api Enumeration

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name), Operation=coalesce(tostring(Properties["Operation Name"]), Name), Route=tostring(parse_url(Url)["Path"]), Code=toint(ResultCode)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| summarize Requests=sum(ItemCount), DistinctOperations=dcount(Operation), DistinctRoutes=dcount(Route), Errors=sum(iff(Code >= 400, ItemCount, 0)), Operations=make_set(Operation, 30), Routes=make_set(Route, 30), ResultCodes=make_set(ResultCode, 12), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP), Country=take_any(ClientCountryOrRegion) by bin(TimeGenerated, 10m), AgentKey, APIName
| extend ErrorRate=round(100.0 * todouble(Errors) / max_of(todouble(Requests), 1.0), 2)
| where Requests >= 20 and (DistinctOperations >= 10 or DistinctRoutes >= 10)
| extend Signal=case(ErrorRate >= 50.0, "HIGH-ERROR API SCANNING", "SUCCESSFUL OR MIXED API ENUMERATION")
| project TimeGenerated, Signal, AgentKey, Caller, ClientIP, Country, APIName, Requests, DistinctOperations, DistinctRoutes, Errors, ErrorRate, Operations, Routes, ResultCodes, FirstSeen, LastSeen
| order by DistinctOperations desc, DistinctRoutes desc

Explanation

This query is designed to detect potential API enumeration or scanning activities using Azure API Management (APIM) data. Here's a simplified breakdown of what it does:

  1. Purpose: The query identifies agents or callers making at least 20 requests across 10 or more different API operations or URL paths within a 10-minute window. This behavior could indicate an attempt to discover or scan API capabilities.

  2. Data Source: It uses data from Application Insights, specifically focusing on application requests (AppRequests).

  3. Detection Logic:

    • It filters requests related to API Management.
    • It groups and summarizes requests by time (in 10-minute bins), agent, and API name.
    • It calculates the number of requests, distinct operations, distinct routes, and errors.
    • It checks if there are at least 20 requests with either 10 or more distinct operations or routes.
    • It classifies the activity as "HIGH-ERROR API SCANNING" if the error rate is 50% or more, otherwise as "SUCCESSFUL OR MIXED API ENUMERATION".

  4. Output: The query outputs details such as the time of detection, type of signal (high-error or successful/mixed), agent key, caller information, client IP, country, API name, and statistics about the requests.

  5. Severity and Tactics: The severity is set to medium, and it aligns with the "Discovery" tactic, referencing techniques T1046 (Network Service Scanning) and T1580 (Cloud Infrastructure Discovery).

  6. Alert and Incident Management:

    • Alerts are generated for each result.
    • Incidents are created and can be grouped by account, with a lookback duration of 12 hours to reopen closed incidents if similar activity is detected again.

  7. Configuration: The query runs every 15 minutes and looks back over the past hour to identify suspicious activity.

Overall, this query helps in identifying potentially malicious activities where someone might be trying to map out or exploit APIs by making numerous requests in a short period.