-
Notifications
You must be signed in to change notification settings - Fork 3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #9975 from praveenthepro/patch-11
Create Protocols passing authentication in cleartext (ASIM Network Se…
- Loading branch information
Showing
10 changed files
with
352 additions
and
118 deletions.
There are no files selected for viewing
53 changes: 53 additions & 0 deletions
53
...ession Essentials/Analytic Rules/Anomaly in SMB Traffic(ASIM Network Session schema).yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| id: 8717e498-7b5d-4e23-9e7c-fa4913dbfd79 | ||
| name: Anomaly in SMB Traffic(ASIM Network Session schema) | ||
| description: | | ||
| 'This detection detects abnormal SMB traffic, a file-sharing protocol. By calculating the average deviation of SMB connections over last 14 days, flagging sources exceeding 50 average deviations.' | ||
| severity: Medium | ||
| status: Available | ||
| tags: | ||
| - Schema: ASimNetworkSessions | ||
| SchemaVersion: 0.2.4 | ||
| requiredDataConnectors: [] | ||
| queryFrequency: 1d | ||
| queryPeriod: 14d | ||
| triggerOperator: gt | ||
| triggerThreshold: 0 | ||
| tactics: | ||
| - LateralMovement | ||
| relevantTechniques: | ||
| - T1021 | ||
| - T1021.002 | ||
| query: | | ||
| // Define the threshold for deviation | ||
| let threshold = 50; | ||
| // Define the time range for the baseline data | ||
| let starttime = 14d; | ||
| let endtime = 1d; | ||
| // Define the SMB ports to monitor | ||
| let SMBPorts = dynamic(["139", "445"]); | ||
| // Get the baseline data for user network sessions and Filter for the defined time range | ||
| let userBaseline = _Im_NetworkSession(starttime=ago(starttime), endtime=ago(endtime)) | ||
| | where ipv4_is_private(SrcIpAddr) and tostring(DstPortNumber) has_any (SMBPorts) and SrcIpAddr != DstIpAddr // Filter for private IP addresses and SMB ports | ||
| | summarize Count = count() by SrcIpAddr, DstPortNumber // Group by source IP and destination port | ||
| | summarize AvgCount = avg(Count) by SrcIpAddr, DstPortNumber; // Calculate the average count | ||
| // Get the recent user activity data and Filter for recent activity | ||
| let recentUserActivity = _Im_NetworkSession(starttime=ago(endtime)) | ||
| | where ipv4_is_private(SrcIpAddr) and tostring(DstPortNumber) has_any (SMBPorts) and SrcIpAddr != DstIpAddr // Filter for private IP addresses and SMB ports | ||
| | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by SrcIpAddr, DstPortNumber; // Group by source IP and destination port | ||
| // Join the baseline and recent activity data | ||
| let UserBehaviorAnalysis = userBaseline | ||
| | join kind=inner (recentUserActivity) on SrcIpAddr, DstPortNumber | ||
| | extend Deviation = abs(RecentCount - AvgCount) / AvgCount; // Calculate the deviation | ||
| // Filter for deviations greater than the threshold | ||
| UserBehaviorAnalysis | ||
| | where Deviation > threshold | ||
| | project SrcIpAddr, DstPortNumber, Deviation, Count = RecentCount; // Project the required columns | ||
| entityMappings: | ||
| - entityType: IP | ||
| fieldMappings: | ||
| - identifier: Address | ||
| columnName: SrcIpAddr | ||
| eventGroupingSettings: | ||
| aggregationKind: AlertPerResult | ||
| version: 1.0.0 | ||
| kind: Scheduled |
39 changes: 39 additions & 0 deletions
39
...ials/Analytic Rules/Remote Desktop Network Brute force (ASIM Network Session schema).yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| id: b7dc801e-1e79-48bb-91e8-2229a8e6d40b | ||
| name: Remote Desktop Network Brute force (ASIM Network Session schema) | ||
| description: | | ||
| 'This detection identifies RDP application network traffic and filters any source/destination pair generating more than 25 events hard threshold.' | ||
| severity: Medium | ||
| status: Available | ||
| tags: | ||
| - Schema: ASimNetworkSessions | ||
| SchemaVersion: 0.2.4 | ||
| requiredDataConnectors: [] | ||
| queryFrequency: 1h | ||
| queryPeriod: 1h | ||
| triggerOperator: gt | ||
| triggerThreshold: 0 | ||
| tactics: | ||
| - CredentialAccess | ||
| relevantTechniques: | ||
| - T1110 | ||
| query: | | ||
| // Start of the query and Filter events that resulted in failure | ||
| _Im_NetworkSession(eventresult="Failure") | ||
| // Filter out private source IP addresses and focus on specific destination port (3389) | ||
| // Also, ensure that the source and destination IP addresses are not the same | ||
| | where not(ipv4_is_private(SrcIpAddr)) and tostring(DstPortNumber) has_any ("3389") and SrcIpAddr != DstIpAddr | ||
| // Summarize the data by source and destination IP addresses, destination port number, network protocol, and event result | ||
| // Also, bin the time generated in 5-minute intervals | ||
| // Calculate the minimum and maximum time generated, the sum of event counts, and a set of up to 10 event vendors | ||
| | summarize Starttime= min(TimeGenerated),EndTime= max(TimeGenerated),TargettedIPs=dcount(DstIpAddr),Eventscount=sum(EventCount),EventVendors=make_set(EventVendor,10) by SrcIpAddr,DstPortNumber,EventResult, bin(TimeGenerated, 5m) | ||
| // Filter the summarized data to include only those with an event count of 25 or more | ||
| | where Eventscount >= 25 | ||
| entityMappings: | ||
| - entityType: IP | ||
| fieldMappings: | ||
| - identifier: Address | ||
| columnName: SrcIpAddr | ||
| eventGroupingSettings: | ||
| aggregationKind: AlertPerResult | ||
| version: 1.0.0 | ||
| kind: Scheduled |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
26 changes: 26 additions & 0 deletions
26
...Essentials/Hunting Queries/Detect Outbound LDAP Traffic(ASIM Network Session schema).yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| id: 5dca6047-24ed-4eb7-b44e-ec7f1bf42621 | ||
| name: Detect Outbound LDAP Traffic(ASIM Network Session schema) | ||
| description: | | ||
| 'Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall.' | ||
| tags: | ||
| - Schema: ASimNetworkSessions | ||
| SchemaVersion: 0.2.4 | ||
| requiredDataConnectors: [] | ||
| tactics: | ||
| - InitialAccess | ||
| - Execution | ||
| relevantTechniques: | ||
| - T1071 | ||
| - T1059 | ||
| query: | | ||
| _Im_NetworkSession(starttime=ago(1d)) | ||
| | where EventResult=="Failure" and ipv4_is_private(SrcIpAddr) and not(ipv4_is_private(DstIpAddr)) and SrcIpAddr != DstIpAddr | ||
| | where tostring(DstPortNumber) has_any ("389", "636") | ||
| | summarize Starttime= min(TimeGenerated),EndTime= max(TimeGenerated),Eventscount=sum(EventCount), EventVendors=make_set(EventVendor,10) by SrcIpAddr,DstIpAddr,DstPortNumber,NetworkProtocol,EventResult | ||
| | extend IP_0_Address = SrcIpAddr | ||
| entityMappings: | ||
| - entityType: IP | ||
| fieldMappings: | ||
| - identifier: Address | ||
| columnName: SrcIpAddr | ||
| version: 1.0.0 |
37 changes: 37 additions & 0 deletions
37
... Queries/Protocols passing authentication in cleartext (ASIM Network Session schema).yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| id: 96f9fdd1-bb5b-4d32-8790-666457dc00c0 | ||
| name: Protocols passing authentication in cleartext (ASIM Network Session schema) | ||
| description: | | ||
| 'This hunting query identifies cleartext protocols like telnet, POP3, IMAP, and non-anonymous FTP that could leak sensitive information. These protocols may use SSL, but usually on different ports.' | ||
| tags: | ||
| - Schema: ASimNetworkSessions | ||
| SchemaVersion: 0.2.4 | ||
| requiredDataConnectors: [] | ||
|
|
||
| tactics: | ||
| - CommandAndControl | ||
| relevantTechniques: | ||
| - T1071 | ||
|
|
||
| query: | | ||
| // Filter events from last 1 day and not failed | ||
| _Im_NetworkSession(starttime=ago(1d)) | ||
| // Filter for private source IP and public destination IP | ||
| | where EventResult != "Failure" and ipv4_is_private(SrcIpAddr) and not(ipv4_is_private(DstIpAddr)) | ||
| // Filter for specific destination ports or non-anonymous FTP | ||
| | where tostring(DstPortNumber) has_any ("23", "143", "110") or (tostring(DstPortNumber) == "21" and SrcUsername != "anonymous") | ||
| // Summarize data by session parameters | ||
| | summarize Starttime= min(TimeGenerated),EndTime= max(TimeGenerated),Eventscount=sum(EventCount), EventVendors=make_set(EventVendor,10) by SrcIpAddr,DstIpAddr,DstPortNumber,NetworkProtocol,EventResult | ||
| | extend PortUsage = case( | ||
| DstPortNumber == 23, "Telnet", | ||
| DstPortNumber == 143, "IMAP", | ||
| DstPortNumber == 110, "POP3", | ||
| DstPortNumber == 21, "FTP", | ||
| "Other" | ||
| ) | ||
| | extend IP_0_Address = SrcIpAddr | ||
| entityMappings: | ||
| - entityType: IP | ||
| fieldMappings: | ||
| - identifier: Address | ||
| columnName: SrcIpAddr | ||
| version: 1.0.0 |
30 changes: 30 additions & 0 deletions
30
...sentials/Hunting Queries/Remote Desktop Network Traffic(ASIM Network Session schema).yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| id: 6fd69768-fdf1-4cfd-805f-b243be3f0c6d | ||
| name: Remote Desktop Network Traffic(ASIM Network Session schema) | ||
| description: | | ||
| 'This hunting query looks for unusual remote desktop activity by monitoring TCP/3389 traffic. While RDP is common, focus on atypical connections to identify potential threats.' | ||
| tags: | ||
| - Schema: ASimNetworkSessions | ||
| SchemaVersion: 0.2.4 | ||
| requiredDataConnectors: [] | ||
| tactics: | ||
| - LateralMovement | ||
| relevantTechniques: | ||
| - T1021 | ||
| - T1021.001 | ||
| query: | | ||
| // Filter events from the last day that were not failures | ||
| _Im_NetworkSession(starttime=ago(1d)) | ||
| // Filter events where the source IP is private, the destination IP is not private, and the source and destination IPs are not the same | ||
| | where EventResult == "Failure" and ipv4_is_private(SrcIpAddr) and not(ipv4_is_private(DstIpAddr)) and SrcIpAddr != DstIpAddr | ||
| // Filter events where the destination port number is 3389 (commonly used for Microsoft Remote Desktop (RDP)) | ||
| | where tostring(DstPortNumber) has_any ("3389") | ||
| // Summarize the data by source IP, destination IP, destination port number, network protocol, and event result | ||
| // For each group, calculate the start time, end time, event count, and a set of up to 10 event vendors | ||
| | summarize Starttime= min(TimeGenerated),EndTime= max(TimeGenerated),Eventscount=sum(EventCount), EventVendors=make_set(EventVendor,10) by SrcIpAddr,DstIpAddr,DstPortNumber,NetworkProtocol,EventResult | ||
| | extend IP_0_Address = SrcIpAddr | ||
| entityMappings: | ||
| - entityType: IP | ||
| fieldMappings: | ||
| - identifier: Address | ||
| columnName: SrcIpAddr | ||
| version: 1.0.0 |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.