detection.wiki

Detection rules › Kusto

Anomaly in SMB Traffic(ASIM Network Session schema)

Status
available
Severity
medium
Time window
14d
Group by
DstPortNumber, SrcIpAddr
Source
github.com/Azure/Azure-Sentinel

This detection detects abnormal SMB traffic, a file-sharing protocol. By calculating the average deviation of SMB connections over last 14 days, flagging sources exceeding 50 average deviations.

MITRE ATT&CK coverage

TacticTechniques
Lateral Movement

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 3: Network connection
Security-AuditingEvent ID 5152: The Windows Filtering Platform blocked a packet.
Security-AuditingEvent ID 5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-AuditingEvent ID 5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-AuditingEvent ID 5156: The Windows Filtering Platform has permitted a connection.
Security-AuditingEvent ID 5157: The Windows Filtering Platform has blocked a connection.
Security-AuditingEvent ID 5158: The Windows Filtering Platform has permitted a bind to a local port.
Security-AuditingEvent ID 5159: The Windows Filtering Platform has blocked a bind to a local port.

Rule body

id: 8717e498-7b5d-4e23-9e7c-fa4913dbfd79
name: Anomaly in SMB Traffic(ASIM Network Session schema)
description: |
  'This detection detects abnormal SMB traffic, a file-sharing protocol. By calculating the average deviation of SMB connections over last 14 days, flagging sources exceeding 50 average deviations.'
severity: Medium
status: Available 
tags:
  - Schema: ASimNetworkSessions
    SchemaVersion: 0.2.4
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1021
  - T1021.002
query: |
  // Define the threshold for deviation
  let threshold = 50;
  // Define the time range for the baseline data
  let starttime = 14d;
  let endtime = 1d;
  // Define the SMB ports to monitor
  let SMBPorts = dynamic(["139", "445"]);
  // Get the baseline data for user network sessions and Filter for the defined time range
  let userBaseline = _Im_NetworkSession(starttime=ago(starttime), endtime=ago(endtime))
    | where ipv4_is_private(SrcIpAddr) and tostring(DstPortNumber) has_any (SMBPorts) and SrcIpAddr != DstIpAddr // Filter for private IP addresses and SMB ports
    | summarize Count = count() by SrcIpAddr, DstPortNumber // Group by source IP and destination port
    | summarize AvgCount = avg(Count) by SrcIpAddr, DstPortNumber; // Calculate the average count
  // Get the recent user activity data and Filter for recent activity
  let recentUserActivity = _Im_NetworkSession(starttime=ago(endtime))
    | where ipv4_is_private(SrcIpAddr) and tostring(DstPortNumber) has_any (SMBPorts) and SrcIpAddr != DstIpAddr // Filter for private IP addresses and SMB ports
    | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by SrcIpAddr, DstPortNumber; // Group by source IP and destination port
  // Join the baseline and recent activity data
  let UserBehaviorAnalysis = userBaseline
    | join kind=inner (recentUserActivity) on SrcIpAddr, DstPortNumber
    | extend Deviation = abs(RecentCount - AvgCount) / AvgCount; // Calculate the deviation
  // Filter for deviations greater than the threshold
  UserBehaviorAnalysis
    | where Deviation > threshold
    | project SrcIpAddr, DstPortNumber, Deviation, Count = RecentCount; // Project the required columns
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 50;
let starttime = 14d;
let endtime = 1d;
let SMBPorts = dynamic(["139", "445"]);

let userBaseline and let UserBehaviorAnalysis are inlined into the numbered stages below.

Let binding: recentUserActivity used in Stages 2, 8

let recentUserActivity = _Im_NetworkSession(starttime=ago(endtime))
  | where ipv4_is_private(SrcIpAddr) and tostring(DstPortNumber) has_any (SMBPorts) and SrcIpAddr != DstIpAddr
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), RecentCount = count() by SrcIpAddr, DstPortNumber;

Stage 1: source

let userBaseline

Stage 2: source

let recentUserActivity

Stage 3: source

let UserBehaviorAnalysis

Stage 4: source

_Im_NetworkSession

Stage 5: where

where (DstPortNumber contains 139 or DstPortNumber contains 445) and (ipv4_is_in_range(SrcIpAddr, "10.0.0.0/8") or ipv4_is_in_range(SrcIpAddr, "172.16.0.0/12") or ipv4_is_in_range(SrcIpAddr, "192.168.0.0/16") or ipv4_is_in_range(SrcIpAddr, "169.254.0.0/16") or ipv4_is_in_range(SrcIpAddr, "127.0.0.0/8")) and SrcIpAddr != DstIpAddr

Stage 6: summarize

summarize Count by SrcIpAddr, DstPortNumber

Stage 7: summarize

summarize AvgCount by SrcIpAddr, DstPortNumber

Stage 8: join

join kind=inner (recentUserActivity) on SrcIpAddr, DstPortNumber

Stage 9: extend

extend Deviation

Stage 10: where

where Deviation > 50

Stage 11: project

project Count, Deviation, DstPortNumber, SrcIpAddr

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Deviationgt
  • 50
field:"Deviation" kind:gt value:"50"
DstPortNumbermatch
  • 139 transforms: tostring, term
  • 445 transforms: tostring, term
field:"DstPortNumber" kind:match
SrcIpAddrcidr_match
  • 10.0.0.0/8 corpus 9 (kusto 7, elastic 2)
  • 127.0.0.0/8 corpus 12 (kusto 7, elastic 5)
  • 169.254.0.0/16 corpus 8 (kusto 7, elastic 1)
  • 172.16.0.0/12 corpus 9 (kusto 7, elastic 2)
  • 192.168.0.0/16 corpus 9 (kusto 7, elastic 2)
field:"src_ip" kind:cidr_match
SrcIpAddrcross_field_compare
  • DstIpAddr transforms: op:ne corpus 2 (kusto 2)
field:"src_ip" kind:cross_field_compare value:"DstIpAddr"

Output fields

These fields are emitted when the rule matches.

FieldSource
Countproject
Deviationproject
DstPortNumberproject
SrcIpAddrproject