Detection rules › Kusto

CiscoISE - Device changed IP in last 24 hours

Status
available
Severity
medium
Time window
1h
Group by
DvcHostname
Source
github.com/Azure/Azure-Sentinel

'Detects when device changes IP address in last 24 hours.'

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

id: 0c509e9b-121e-4951-9f9b-43722e052b4f
name: CiscoISE - Device changed IP in last 24 hours
description: |
  'Detects when device changes IP address in last 24 hours.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1568
query: |
  let lbtime_48h = 48h;
  let lbtime_24h = 24h;
  CiscoISEEvent
  | where TimeGenerated between (ago(lbtime_48h) .. ago(lbtime_24h))
  | where notempty(DvcIpAddr) and notempty(DvcHostname)
  | summarize knownIPs = make_set(DvcIpAddr) by DvcHostname
  | join (CiscoISEEvent
        | where TimeGenerated > ago(lbtime_24h)
        | where notempty(DvcIpAddr) and notempty(DvcHostname)
        | summarize evts = count() by DvcHostname, DvcIpAddr
        | project-away evts) on DvcHostname
  | project-away DvcHostname1
  | where knownIPs !contains DvcIpAddr
  | extend HostCustomEntity = DvcHostname
  | extend IPCustomEntity = DvcIpAddr
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let lbtime_48h = 48h;
let lbtime_24h = 24h;

Stage 1: source

CiscoISEEvent

Stage 2: where

| where TimeGenerated between (ago(lbtime_48h) .. ago(lbtime_24h))

Stage 3: where

| where notempty(DvcIpAddr) and notempty(DvcHostname)

Stage 4: summarize

| summarize knownIPs = make_set(DvcIpAddr) by DvcHostname

Stage 5: join

| join (CiscoISEEvent
      | where TimeGenerated > ago(lbtime_24h)
      | where notempty(DvcIpAddr) and notempty(DvcHostname)
      | summarize evts = count() by DvcHostname, DvcIpAddr
      | project-away evts) on DvcHostname

Stage 6: project-away

| project-away DvcHostname1

Stage 7: where

| where knownIPs !contains DvcIpAddr

Stage 8: extend

| extend HostCustomEntity = DvcHostname

Stage 9: extend

| extend IPCustomEntity = DvcIpAddr

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DvcHostnameis_not_null
  • (no value, null check)
field:"DvcHostname" kind:is_not_null
DvcIpAddris_not_null
  • (no value, null check)
field:"host.ip" kind:is_not_null
knownIPscross_field_compare
  • DvcIpAddr transforms: op:not_contains
field:"knownIPs" kind:cross_field_compare value:"DvcIpAddr"

Output fields

These fields are emitted when the rule matches.

FieldSource
DvcHostnamesummarize
knownIPssummarize
HostCustomEntityextend
IPCustomEntityextend