France Identité (ANTS) Breach: Detecting IDOR Exploitation and Data Scraping

---
title: Potential Web Scraping via Sequential ID Access
id: 8a2b1c9d-3e4f-4a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects potential web scraping or IDOR exploitation by identifying a single client IP generating a high volume of 200 OK responses to endpoints containing numeric identifiers.
references:
 - https://attack.mitre.org/techniques/T1119/
author: Security Arsenal
date: 2025/01/14
tags:
 - attack.collection
 - attack.t1119
logsource:
 category: webserver
 product: apache
# Note: Adapt logsource for Nginx or IIS as needed, field names may vary (cs_uri_query vs uri_query)
detection:
 selection:
    sc_status: 200
    cs_uri_query|contains: 'id='
  condition: selection | count() by client_ip > 1000
 timeframe: 5m
falsepositives:
  - Legitimate heavy usage by automated testing tools
  - Misconfigured monitoring bots
level: high
---
title: High Volume User-Agent Anomaly
id: 9b3c2d0e-4f5a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects traffic from sources with unusually high request rates that do not identify as standard search engine bots.
references:
 - https://attack.mitre.org/techniques/T1119/
author: Security Arsenal
date: 2025/01/14
tags:
 - attack.collection
 - attack.t1119
logsource:
 category: proxy
 product: firewall
detection:
 selection:
    sc_status: 200
  filter_main_bots:
    cs_user_agent|contains:
      - 'bot'
      - 'spider'
      - 'crawl'
  condition: selection and not filter_main_bots | count() by src_ip > 500
 timeframe: 2m
falsepositives:
  - Aggressive API clients
  - Legacy internal applications
level: medium

// Hunt for IDOR scraping: High volume of requests to ID-based endpoints
let Threshold = 1000; // Adjust based on baseline traffic
let TimeWindow = 5m;
CommonSecurityLog
| where TimeGenerated > ago(TimeWindow)
| where DeviceAction in ("GET", "POST") and HttpStatusCode == 200
// Look for common ID patterns in URI Query or RequestURL
| where RequestURL matches regex @"id=[0-9]+" or RequestURL matches regex @"/\d{4,}" 
| summarize Count = count(), RequestedEndpoints = makeset(RequestURL) by SourceIP, UserAgent
| where Count > Threshold
| extend Timestamp = now()
| order by Count desc

-- Hunt for processes commonly used in web scraping tools or scripts
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name IN ('python.exe', 'python3.exe', 'node.exe', 'powershell.exe', 'curl.exe', 'wget.exe')
  AND (
    CommandLine =~ 'requests' OR 
    CommandLine =~ 'http' OR
    CommandLine =~ 'download' OR
    CommandLine =~ 'scrape'
  )

-- Hunt for established network connections to non-standard ports often used in C2 or exfil
SELECT Fd, Family, RemoteAddr, RemotePort, State, Pid
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND RemotePort NOT IN (80, 443, 22, 53, 88, 389, 636, 3389, 5985, 5986)

# Audit IIS Logging for Detection Readiness
Import-Module WebAdministration

$Sites = Get-Website
$AuditResults = @()

foreach ($Site in $Sites) {
    $LogPath = "$($Site.LogFile.Directory)\W3SVC$($Site.ID)"
    $LogFormat = (Get-ItemProperty "IIS:\Sites\$($Site.Name)" -Name logfile).logFormat
    
    # Check for custom fields (needed for detecting IDOR like Username or Cookie)
    $CustomFields = Get-WebConfigurationProperty -Filter "/system.applicationHost/sites/site[@name='$($Site.Name)']/logFile/customFields" -Name .
    
    $IsCompliant = $false
    if ($LogFormat -eq 'W3C') {
        # Ensure critical fields are enabled (Query String is vital for IDOR detection)
        $LogFields = Get-WebConfigurationProperty -Filter "/system.applicationHost/sites/site[@name='$($Site.Name)']/logFile" -Name "logExtFileFlags"
        
        if ($LogFields.Value -match 'Date' -and $LogFields.Value -match 'Time' -and $LogFields.Value -match 'UriQuery' -and $LogFields.Value -match 'HttpSubStatus') {
            $IsCompliant = $true
        }
    }
    
    $AuditResults += [PSCustomObject]@{
        SiteName = $Site.Name
        LogPath = $LogPath
        Format = $LogFormat
        QueryStringLoggingEnabled = ($LogFields.Value -match 'UriQuery')
        ComplianceStatus = if ($IsCompliant) { "PASS" } else { "FAIL" }
    }
}

$AuditResults | Format-Table -AutoSize

# Alert if any site is non-compliant
$NonCompliant = $AuditResults | Where-Object { $_.ComplianceStatus -eq "FAIL" }
if ($NonCompliant) {
    Write-Warning "Action Required: IIS Logging on the following sites is not configured optimally for Web Attack detection. Ensure 'UriQuery' is enabled."
}