Whisper Security - ASN Reputation Degradation

Status: available
Severity: medium
Time window: 1d
Group by: asn
Source: github.com/Azure/Azure-Sentinel

Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1583` Acquire Infrastructure

Rule body

id: 32e7bcab-4424-516e-9c7c-dbe868144494
name: Whisper Security - ASN Reputation Degradation
description: |
  Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: WhisperSecurityConnector
  dataTypes:
  - WhisperASNReputation_CL
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
- ResourceDevelopment
relevantTechniques:
- T1583
query: |
  // MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server
  // Tactic: Resource Development
  // Detects ASN reputation degradation (score increase > 20 points in 24h)
  // Note: Higher reputationScore = worse reputation
  let degradationThreshold = 20;
  let currentScores = WhisperASNReputation_CL
      | where TimeGenerated > ago(1h)
      | summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn
      | project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;
  let previousScores = WhisperASNReputation_CL
      | where TimeGenerated between (ago(1d) .. ago(1h))
      | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
      | project asn, PreviousScore;
  currentScores
      | join kind=inner (previousScores) on asn
      | extend ScoreDelta = CurrentScore - PreviousScore
      | where ScoreDelta > degradationThreshold
      | project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount
customDetails:
  ASN: ASN
  AsnName: AsnName
  OldScore: OldScore
  NewScore: NewScore
  ScoreDelta: ScoreDelta
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let degradationThreshold = 20;

let currentScores is inlined into the numbered stages below.

Let binding: `previousScores` used in Stage 5

let previousScores = WhisperASNReputation_CL
    | where TimeGenerated between (ago(1d) .. ago(1h))
    | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
    | project asn, PreviousScore;

Stages 1 to 4 define let currentScores (the rule's main pipeline source); stages 5 to 8 run on it.

Stage 1: `source`

WhisperASNReputation_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `summarize`

| summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn

Stage 4: `project`

| project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount

Stage 5: `join`

currentScores
| join kind=inner (previousScores) on asn

Stage 6: `extend`

| extend ScoreDelta = CurrentScore - PreviousScore

Stage 7: `where`

| where ScoreDelta > degradationThreshold

Stage 8: `project`

| project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScoreDelta`	gt	`20`	`field:"ScoreDelta" kind:gt value:"20"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ASN`	`project`
`AsnName`	`project`
`Country`	`project`
`CurrentLevel`	`project`
`NewScore`	`project`
`OldScore`	`project`
`PeerCount`	`project`
`PrefixCount`	`project`
`ScoreDelta`	`project`
`TimeGenerated`	`project`

Whisper Security - ASN Reputation Degradation

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: previousScores used in Stage 5

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: project

Stage 5: join

Stage 6: extend

Stage 7: where

Stage 8: project