SonicWall - Allowed SSH, Telnet, and RDP Connections

Status: experimental
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application
Execution	`T1059` Command and Scripting Interpreter
Persistence	`T1133` External Remote Services
Credential Access	`T1003` OS Credential Dumping `T1110` Brute Force
Discovery	`T1018` Remote System Discovery `T1087` Account Discovery
Lateral Movement	`T1021` Remote Services
Collection	`T1005` Data from Local System
Exfiltration	`T1011` Exfiltration Over Other Network Medium `T1041` Exfiltration Over C2 Channel `T1048` Exfiltration Over Alternative Protocol `T1567` Exfiltration Over Web Service
Impact	`T1490` Inhibit System Recovery

Rule body

id: 27f1a570-5f20-496b-88f6-a9aa2c5c9534
name: SonicWall - Allowed SSH, Telnet, and RDP Connections
description: |
  'This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).'
severity: Medium
status: Experimental
requiredDataConnectors:
  - connectorId: CEF
    dataTypes:
      - CommonSecurityLog
  - connectorId: SonicWallFirewall
    dataTypes:
      - ASimNetworkSessionSonicWallFirewall
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - Persistence
  - CredentialAccess
  - Discovery
  - LateralMovement
  - Collection
  - Exfiltration
  - Impact
relevantTechniques:
  - T1190
  - T1133
  - T1059
  - T1133
  - T1110
  - T1003
  - T1087
  - T1018
  - T1021
  - T1005
  - T1048
  - T1041
  - T1011
  - T1567
  - T1490
query: |
  ASimNetworkSessionSonicWallFirewall(false)
  | where NetworkDirection == "Inbound" and EventResult in ("NA", "Success")
  | where EventOriginalType != 1370
  | where SrcAppName contains "Windows Remote Desktop Services"
      or SrcAppName contains "Telnet"
      or (SrcAppName contains "SSH Protocol" and ThreatId != 446) // Filters out SSH server responses.
      or SrcAppName contains "Bitvise SSH"
      or DstPortNumber in (22, 23, 3389)
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DstIpAddr
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ASimNetworkSessionSonicWallFirewall(false)

Stage 2: `where`

| where NetworkDirection == "Inbound" and EventResult in ("NA", "Success")

Stage 3: `where`

| where EventOriginalType != 1370

Stage 4: `where`

| where SrcAppName contains "Windows Remote Desktop Services"
    or SrcAppName contains "Telnet"
    or (SrcAppName contains "SSH Protocol" and ThreatId != 446)
    or SrcAppName contains "Bitvise SSH"
    or DstPortNumber in (22, 23, 3389)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DstPortNumber`	in	`22` `23` `3389`	`field:"DstPortNumber" kind:in`
`EventOriginalType`	ne	`1370`	`field:"EventOriginalType" kind:ne value:"1370"`
`EventResult`	in	`NA` `Success`	`field:"EventResult" kind:in`
`NetworkDirection`	eq	`Inbound`	`field:"NetworkDirection" kind:eq value:"Inbound"`
`SrcAppName`	contains	`Bitvise SSH` `SSH Protocol` `Telnet` `Windows Remote Desktop Services`	`field:"SrcAppName" kind:contains`
`ThreatId`	ne	`446`	`field:"ThreatId" kind:ne value:"446"`

SonicWall - Allowed SSH, Telnet, and RDP Connections

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Indicators

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`