KQL Search

Query Details

APIM AI Gateway - Command-capable tool exposed

APIM Command Capable Tool Definition

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"]), RequestJson=parse_json(tostring(Properties["Request-Body"]))
| extend Input=tostring(RequestJson.input), Instructions=tostring(RequestJson.instructions), Model=tostring(RequestJson.model), Tools=tostring(RequestJson.tools)
| where Tools matches regex @"(?i)(run[_ -]?(shell|command|code)|execute[_ -]?(shell|command|code)|powershell|cmd\.exe|terminal|reverse[_ -]?shell|metasploit|kali|ssh[_ -]?exec|remote[_ -]?code[_ -]?execution)"
| extend Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), RequestId=tostring(Properties["Request Id"]), APIName=tostring(Properties["API Name"])
| project TimeGenerated, Signal="COMMAND-CAPABLE TOOL EXPOSED", Caller, Success, ResultCode, APIName, Name, Url, Model, Input, Instructions, Tools, RequestBody, ResponseBody, RequestId, OperationId

Explanation

This query is designed to detect potentially dangerous requests made to an API Management (APIM) service that might indicate an attempt to execute commands or run code. Here's a simple breakdown:

  • Purpose: The query looks for requests that include terms related to executing commands or code, such as "shell," "command," "PowerShell," "terminal," "SSH," "reverse-shell," or other offensive tools.
  • Data Source: It uses data from Application Insights, specifically focusing on application requests (AppRequests).
  • Frequency: The query runs every hour and checks data from the past hour.
  • Alert Trigger: An alert is triggered if any such request is detected (threshold is greater than 0).
  • Severity: The alert is marked as high severity.
  • Details Captured: When a suspicious request is found, it captures details like the caller, request and response bodies, API name, and other relevant information.
  • Entities Mapped: It maps certain fields to entities like Account, Cloud Application, and URL for better context.
  • Incident Management: If an alert is triggered, it creates an incident and groups related alerts by account within a 12-hour lookback period.
  • Tags: The query is tagged with terms like Sentinel-As-Code, Custom, APIM, AI, and OWASP-LLM08, indicating its relevance to these areas.

Overall, this query helps in identifying and alerting on potentially malicious activities involving command execution capabilities exposed through API requests.