Anomalous User Agent connection attempt

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	f845881e-2500-44dc-8ed7-b372af3e1e25
Severity	Low
Kind	Scheduled
Tactics	InitialAccess
Techniques	T1190
Required Connectors	AzureMonitor(IIS)
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
W3CIISLog	✓	✗	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
ESI-Opt5ExchangeIISLogs	Microsoft Exchange Security - Exchange On-Premises

Solutions: Microsoft Exchange Security - Exchange On-Premises

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules