Skip to content

Commit 6fcc5ac

Browse files
duongauduongau
committed
docs: fix metadata, stale language, product names, code block, style edits
1 parent d05e5b9 commit 6fcc5ac

1 file changed

Lines changed: 83 additions & 95 deletions

File tree

‎articles/firewall/detect-malware-with-sentinel.md‎

Lines changed: 83 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,135 +1,123 @@
11
---
22
title: Detect malware with Microsoft Sentinel for Azure Firewall
3-
description: This article shows you how you can detect malware with the Azure Firewall solution for Microsoft Sentinel.
3+
description: Learn how to detect and respond to common malware threats such as Coinminer, Cl0p, and Sunburst using KQL detection queries in Microsoft Sentinel with Azure Firewall logs.
44
author: duongau
55
ms.author: duau
66
ms.service: azure-firewall
77
ms.topic: how-to
8-
ms.date: 01/23/2024
8+
ms.date: 03/28/2026
99
# Customer intent: "As a security analyst, I want to implement malware detection using Azure Firewall logs with Microsoft Sentinel, so that I can proactively identify and respond to threats like Coinminer, Cl0p, and Sunburst to protect our network from potential attacks."
1010
---
1111

1212
# Detect malware with Microsoft Sentinel for Azure Firewall
1313

14-
Malware is any software that is designed to cause damage, disruption, or compromise the security and functionality of computer systems, networks, or devices. It includes diverse types of threats, such as viruses, worms, trojans, ransomware, spyware, adware, rootkits, and more. Malware can have various negative impacts, such as stealing sensitive data, encrypting, or deleting files, displaying unwanted ads, slowing down performance, or even taking control of the device.
14+
Malware is any software designed to cause damage, disruption, or compromise the security and functionality of computer systems, networks, or devices. It includes diverse types of threats, such as viruses, worms, trojans, ransomware, spyware, adware, rootkits, and more. Malware can have various negative impacts, such as stealing sensitive data, encrypting or deleting files, displaying unwanted ads, slowing down performance, or even taking control of the device.
1515

16-
It's important to identify and eliminate malware from a system or network, which you can do by employing various detection techniques, such as signature-based, behavior-based, heuristic-based, or machine learning-based techniques. Malware detection is vital for protecting the security and privacy of users, as well as the integrity and availability of systems and networks.
16+
It's important to identify and eliminate malware from a system or network. You can do this by employing various detection techniques, such as signature-based, behavior-based, heuristic-based, or machine learning-based techniques. Malware detection is vital for protecting the security and privacy of users, as well as the integrity and availability of systems and networks.
1717

18-
The Azure Firewall IDPS feature automatically detects and denies malware by default and can prevent the cloud workloads from being infected. You can further enhance this capability by employing automated detection and response using prebuilt detection queries and Microsoft Sentinel. In this article, you explore how to detect some common malware found in Azure Firewall logs such as `Coinminer`, `Cl0p` and `Sunburst` using predefined KQL detection queries for Azure Firewall.
18+
The Azure Firewall IDPS feature automatically detects and denies malware by default and can prevent the cloud workloads from being infected. You can further enhance this capability by employing automated detection and response by using prebuilt detection queries and Microsoft Sentinel. You can detect some common malware found in Azure Firewall logs such as `Coinminer`, `Cl0p`, and `Sunburst` using predefined KQL detection queries for Azure Firewall.
1919

20-
These detections enable security teams to receive Sentinel alerts when machines on the internal network request connections to domain names or IP addresses on the Internet that are linked to known Indicators of Compromise (IOCs), as defined in the detection rule query. True positive detections should be regarded as Indicators of Compromise (IOCs). Then, security incident response teams can initiate a response and implement appropriate custom remediation actions based on these detection signals.
20+
These detections enable security teams to receive Microsoft Sentinel alerts when machines on the internal network request connections to domain names or IP addresses on the Internet that are linked to known Indicators of Compromise (IOCs), as defined in the detection rule query. True positive detections should be regarded as IOCs. Then, security incident response teams can initiate a response and implement appropriate custom remediation actions based on these detection signals.
2121

22-
23-
24-
For instructions to deploy the analytic rules using the following queries, see [Detect new threats using Microsoft Sentinel with Azure Web Application Firewall](../web-application-firewall/waf-new-threat-detection.md).
22+
For instructions to deploy the analytic rules by using the following queries, see [Detect new threats using Microsoft Sentinel with Azure Web Application Firewall](../web-application-firewall/waf-new-threat-detection.md).
2523

2624
## Common malware exploits
2725

2826
The following malware exploits are common on today's networks.
2927

30-
### `Coinminer`
28+
### Coinminer
3129

32-
Due to the recent surge in cryptocurrency mining, there's an increasing need for high-performance network processing units. Distributed computing is expanding and the widespread availability of mining software, both in legal and illegal contexts.
30+
Due to the recent surge in cryptocurrency mining, there's an increasing need for high-performance network processing units. Distributed computing is expanding and the widespread availability of mining software, both in legal and illegal contexts.
3331

34-
`Coinminer` represents a type of malware that uses the hardware resources of an unwitting victim's computer for cryptocurrency mining. The graphics processing unit (GPU) of the unsuspecting user's PC is used to run various scripts aimed at mining cryptocurrencies and calculating transaction block hashes.
32+
`Coinminer` represents a type of malware that uses the hardware resources of an unwitting victim's computer for cryptocurrency mining. The graphics processing unit (GPU) of the unsuspecting user's PC is used to run various scripts aimed at mining cryptocurrencies and calculating transaction block hashes.
3533

36-
To mitigate the risk of these threats, proactive measures should be implemented at the typical entry points. This includes ensuring that Jupyter software is deployed with proper authentication, configuring, and updating web applications to minimize vulnerabilities, controlling external access to Docker, and following extra Zero Trust principles.
34+
To mitigate the risk of these threats, implement proactive measures at the typical entry points. This approach includes ensuring that Jupyter software is deployed with proper authentication, configuring and updating web applications to minimize vulnerabilities, controlling external access to Docker, and following extra Zero Trust principles.
3735

38-
The following detection query can be used to create an analytics rule in Sentinel to automatically detect and respond to this malware using Azure Firewall logs.
36+
Use the following detection query to create an analytics rule in Microsoft Sentinel that automatically detects and responds to this malware by using Azure Firewall logs.
3937

40-
```
38+
```kusto
4139
// Coinminer Detection Rule
42-
// Detects suspicious traffic patterns associated with coinmining activity in Azure Firewall logs for Sentinel
43-
44-
let coinminerPorts = dynamic(["2375", "2376", "2377", "4243", "4244"]); // List of known coinminer ports
45-
//Assign the known domains to a variable
46-
let coinminerdomains = dynamic(["teamtnt.red", "kaiserfranz.cc", "45.9.148.123"]); // List of known coinminer domains
47-
48-
(union isfuzzy=true
49-
50-
(AzureDiagnostics
51-
| where ResourceType == "AZUREFIREWALLS"
52-
| where Category == "AzureFirewallApplicationRule"
53-
| parse msg_s with Protocol 'request from ' SourceHost ':' SourcePort 'to ' DestinationHost ':' DestinationPort '. Action:' Action
54-
| extend action_s = column_ifexists("action_s", ""), transactionId_g = column_ifexists("transactionId_g", "")
55-
| where DestinationPort in (coinminerPorts) // Filter traffic on known coinminer ports
56-
| summarize CoinminerAttempts = count() by DestinationHost, DestinationPort
57-
| where CoinminerAttempts > 10 // Adjust threshold as needed
58-
),
59-
60-
(AZFWIdpsSignature
61-
| where DestinationPort in (coinminerPorts)
62-
| summarize CoinminerAttempts = count() by DestinationIp, DestinationPort
63-
| where CoinminerAttempts > 10 // Adjust threshold as needed
64-
65-
),
66-
67-
(AzureDiagnostics
68-
| where ResourceType == "AZUREFIREWALLS"
69-
| where Category == "AzureFirewallDnsProxy"
70-
| parse msg_s with "DNS Request: " ClientIP ":" ClientPort " - " QueryID " " Request_Type " " Request_Class " " Request_Name ". " Request_Protocol " " Request_Size " " EDNSO_DO " " EDNS0_Buffersize " " Response_Code " " Response_Flags " " Response_Size " " Response_Duration
71-
| where Request_Name has_any(coinminerdomains)
72-
| extend DNSName = Request_Name
73-
| extend IPCustomEntity = ClientIP
74-
75-
),
76-
77-
(AzureDiagnostics
78-
| where ResourceType == "AZUREFIREWALLS"
79-
| where Category == "AzureFirewallApplicationRule"
80-
| parse msg_s with Protocol ' request from ' SourceHost ':' SourcePort 'to' DestinationHost ':' DestinationPort '. Action:' Action
81-
| where isnotempty(DestinationHost)
82-
| where DestinationHost has_any(coinminerdomains)
83-
| extend DNSName = DestinationHost
84-
| extend IPCustomEntity = SourceHost),
85-
86-
(AZFWApplicationRule
87-
| where isnotempty(Fqdn)
88-
| where Fqdn has_any (coinminerdomains)
89-
| extend DNSName = Fqdn
90-
| extend IPCustomEntity = SourceIp),
91-
92-
(AZFWDnsQuery
93-
| where isnotempty(QueryName)
94-
| where QueryName has_any (coinminerdomains)
95-
| extend DNSName = QueryName
96-
| extend IPCustomEntity = SourceIp
97-
98-
),
99-
100-
(AZFWIdpsSignature
101-
| where DestinationIp has_any (coinminerdomains)
102-
| extend DNSName = DestinationIp
103-
| extend IPCustomEntity = SourceIp
104-
105-
),
106-
107-
(AZFWIdpsSignature
108-
| where Description contains "coinminer"
109-
| extend DNSName = DestinationIp
110-
| extend IPCustomEntity = SourceIp
111-
)
112-
113-
)
40+
// Detects suspicious traffic patterns associated with coinmining activity in Azure Firewall logs
41+
42+
// Known coinminer ports and domains
43+
let coinminerPorts = dynamic(["2375", "2376", "2377", "4243", "4244"]);
44+
let coinminerdomains = dynamic(["teamtnt.red", "kaiserfranz.cc", "45.9.148.123"]);
45+
46+
union isfuzzy=true
47+
// 1. Legacy diagnostics logs - port-based detection (Application rules)
48+
(AzureDiagnostics
49+
| where ResourceType == "AZUREFIREWALLS"
50+
| where Category == "AzureFirewallApplicationRule"
51+
| parse msg_s with Protocol 'request from ' SourceHost ':' SourcePort 'to ' DestinationHost ':' DestinationPort '. Action:' Action
52+
| extend action_s = column_ifexists("action_s", ""), transactionId_g = column_ifexists("transactionId_g", "")
53+
| where DestinationPort in (coinminerPorts)
54+
| summarize CoinminerAttempts = count() by DestinationHost, DestinationPort
55+
| where CoinminerAttempts > 10 // Adjust threshold as needed
56+
),
57+
// 2. Structured logs - port-based detection (IDPS signatures)
58+
(AZFWIdpsSignature
59+
| where DestinationPort in (coinminerPorts)
60+
| summarize CoinminerAttempts = count() by DestinationIp, DestinationPort
61+
| where CoinminerAttempts > 10 // Adjust threshold as needed
62+
),
63+
// 3. Legacy diagnostics logs - domain-based detection (DNS proxy)
64+
(AzureDiagnostics
65+
| where ResourceType == "AZUREFIREWALLS"
66+
| where Category == "AzureFirewallDnsProxy"
67+
| parse msg_s with "DNS Request: " ClientIP ":" ClientPort " - " QueryID " " Request_Type " " Request_Class " " Request_Name ". " Request_Protocol " " Request_Size " " EDNSO_DO " " EDNS0_Buffersize " " Response_Code " " Response_Flags " " Response_Size " " Response_Duration
68+
| where Request_Name has_any(coinminerdomains)
69+
| extend DNSName = Request_Name, IPCustomEntity = ClientIP
70+
),
71+
// 4. Legacy diagnostics logs - domain-based detection (Application rules)
72+
(AzureDiagnostics
73+
| where ResourceType == "AZUREFIREWALLS"
74+
| where Category == "AzureFirewallApplicationRule"
75+
| parse msg_s with Protocol ' request from ' SourceHost ':' SourcePort 'to' DestinationHost ':' DestinationPort '. Action:' Action
76+
| where isnotempty(DestinationHost)
77+
| where DestinationHost has_any(coinminerdomains)
78+
| extend DNSName = DestinationHost, IPCustomEntity = SourceHost
79+
),
80+
// 5. Structured logs - domain-based detection (Application rules)
81+
(AZFWApplicationRule
82+
| where isnotempty(Fqdn)
83+
| where Fqdn has_any(coinminerdomains)
84+
| extend DNSName = Fqdn, IPCustomEntity = SourceIp
85+
),
86+
// 6. Structured logs - domain-based detection (DNS queries)
87+
(AZFWDnsQuery
88+
| where isnotempty(QueryName)
89+
| where QueryName has_any(coinminerdomains)
90+
| extend DNSName = QueryName, IPCustomEntity = SourceIp
91+
),
92+
// 7. Structured logs - domain-based detection (IDPS signatures)
93+
(AZFWIdpsSignature
94+
| where DestinationIp has_any(coinminerdomains)
95+
| extend DNSName = DestinationIp, IPCustomEntity = SourceIp
96+
),
97+
// 8. Structured logs - signature description-based detection (IDPS)
98+
(AZFWIdpsSignature
99+
| where Description contains "coinminer"
100+
| extend DNSName = DestinationIp, IPCustomEntity = SourceIp
101+
)
114102
```
115103

116-
### `Cl0p`
104+
### Cl0p
117105

118-
`Cl0p` is a ransomware that operates by applying distinctive encryption keys to the victim's files and then requesting a ransom for the files' decryption. It uses a vulnerability in the data transfer software MOVEit and sends spear phishing emails to numerous employees in the hope to deliver `cl0p`. Then it uses tools like `truebot` and `dewmode` to move laterally within the network and exfiltrate data. The ransomware encrypts files using the AES-256 encryption algorithm.
106+
`Cl0p` is ransomware that operates by applying distinctive encryption keys to the victim's files and then requesting a ransom for the files' decryption. It uses a vulnerability in the data transfer software MOVEit and sends spear phishing emails to numerous employees in the hope of delivering `cl0p`. Then it uses tools like `truebot` and `dewmode` to move laterally within the network and exfiltrate data. The ransomware encrypts files by using the AES-256 encryption algorithm.
119107

120-
`Cl0p` vulnerabilities include CVE-2023-35036, CVE-2023-34362 and CVE-2023-35708. In June 2023, the FBI and CISA published a press release about this exploitation. The effects of `cl0p` ransomware are registered across several universities in the US Midwest and government organizations. Airlines, TV networks, and UK based retail stores are the latest victims of the `cl0p` ransomware gang.
108+
`Cl0p` vulnerabilities include CVE-2023-35036, CVE-2023-34362, and CVE-2023-35708. In June 2023, the FBI and CISA published a press release about this exploitation. The effects of `cl0p` ransomware are registered across several universities in the US Midwest and government organizations. Airlines, TV networks, and UK-based retail stores are the latest victims of the `cl0p` ransomware gang.
121109

122-
The following detection query can be used to create an analytics rule in Sentinel to automatically detect and respond to this malware using Azure Firewall logs.
110+
Use the following detection query to create an analytics rule in Microsoft Sentinel that automatically detects and responds to this malware by using Azure Firewall logs.
123111

124112
Detection Query for `Cl0p`: [Firewall Malware Detections for Sentinel/Detection - Analytic rule query for Cl0p.json](https://github.com/Azure/Azure-Network-Security/blob/master/Azure%20Firewall/Playbook%20-%20Firewall%20Malware%20Detections%20for%20Sentinel/Detection%20-%20Analytic%20rule%20query%20for%20Cl0p.json)
125113

126-
## `Sunburst`
114+
## Sunburst malware
127115

128-
This malware targets victims by using domain generation algorithm (DGA) strings to evade detection and establish a command-and-control backdoor attack. The DGA strings are often difficult for security tools to identify the domains used by the malware due to the pattern used in the syntax and their constant changing of the domain information.
116+
This malware uses a domain generation algorithm (DGA) to evade detection and establish a command-and-control backdoor attack. The pattern used in the syntax and constant changing of the domain information make it difficult for security tools to identify the domains used by the malware.
129117

130-
The following detection query can be used to create an analytics rule in Sentinel to automatically detect and respond to this malware using Azure Firewall logs.
118+
Use the following detection query to create an analytics rule in Microsoft Sentinel that automatically detects and responds to this malware by using Azure Firewall logs.
131119

132-
Detection Query for `Sunburst` Malware: [Firewall Malware Detections for Sentinel/Detection - Analytic rule query for Sunburst.json](https://github.com/Azure/Azure-Network-Security/blob/master/Azure%20Firewall/Playbook%20-%20Firewall%20Malware%20Detections%20for%20Sentinel/Detection%20-%20Analytic%20rule%20query%20for%20Sunburst.json)
120+
Detection query for `Sunburst` malware: [Firewall Malware Detections for Sentinel/Detection - Analytic rule query for Sunburst.json](https://github.com/Azure/Azure-Network-Security/blob/master/Azure%20Firewall/Playbook%20-%20Firewall%20Malware%20Detections%20for%20Sentinel/Detection%20-%20Analytic%20rule%20query%20for%20Sunburst.json)
133121

134122
## Related content
135123

0 commit comments

Comments
 (0)