← Back to SOC feed Coverage →

Same IP address with multiple csUserAgent

kql MEDIUM Azure-Sentinel
T1190
W3CIISLog
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-04T23:00:00Z · Confidence: medium

Hunt Hypothesis

A malicious actor may be using a single IP address to probe multiple systems by rotating user agents to evade detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential reconnaissance or initial access attempts.

KQL Query


W3CIISLog
| where scStatus !startswith "20" and scStatus !startswith "30" and cIP !startswith "192.168." and cIP != sIP and cIP != "::1"
//Exclude local addresses, using ipv4_is_private operator
|where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), makeset(csUserAgent), ConnectionCount = count() 
by Computer, sSiteName, sIP, sPort, cIP, csMethod
| extend csUserAgentPerIPCount = arraylength(set_csUserAgent)
| where  csUserAgentPerIPCount between ( 2 .. 15 ) and ConnectionCount <=50
| extend timestamp = StartTime, IPCustomEntity = cIP, HostCustomEntity = Computer

Analytic Rule Definition

id: 4edbb420-2df7-4089-9906-c335f065803e
name: Same IP address with multiple csUserAgent
description: |
  'This alerts when a client IP connects with 1-15 different useragents in less than 1 hour. Limited to 50 or less connections to avoid high traffic. May indicate malicious activity as a probing method.'
description_detailed: |
  'This alerts when the same client IP (cIP) is connecting with more than 1 but less than 15 different useragent string (csUserAgent) in less than 1 hour.
  We limit to 50 or less connections to avoid high traffic sites. This may indicate malicious activity as this is a method of probing an environment
  References: Status code mappings for your convenience
  IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
  Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |

  W3CIISLog
  | where scStatus !startswith "20" and scStatus !startswith "30" and cIP !startswith "192.168." and cIP != sIP and cIP != "::1"
  //Exclude local addresses, using ipv4_is_private operator
  |where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), makeset(csUserAgent), ConnectionCount = count() 
  by Computer, sSiteName, sIP, sPort, cIP, csMethod
  | extend csUserAgentPerIPCount = arraylength(set_csUserAgent)
  | where  csUserAgentPerIPCount between ( 2 .. 15 ) and ConnectionCount <=50
  | extend timestamp = StartTime, IPCustomEntity = cIP, HostCustomEntity = Computer
version: 1.0.1
metadata:
    source:
        kind: Community
    author:
        name: Shain
    support:
        tier: Community
    categories:
        domains: [ "Security - Network" ]

Required Data Sources

Sentinel TableNotes
W3CIISLogEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/W3CIISLog/ClientIPwithManyUserAgents.yaml