URI requests from single client

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This finds connections to server files requested by only one client. Effective when actor uses static operational IP addresses. Threshold can be modified. Larger execution window increases reliability of results.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	a787a819-40df-4c9f-a5ae-850d5a2a0cf6
Severity	Low
Tactics	InitialAccess
Techniques	T1190
Required Connectors	AzureMonitor(IIS)
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
W3CIISLog	✓	✗	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
ESI-Opt5ExchangeIISLogs	Microsoft Exchange Security - Exchange On-Premises

Solutions: Microsoft Exchange Security - Exchange On-Premises

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries