Corelight - Network Service Scanning Multiple IP Addresses

Status: available
Severity: medium
Time window: 1m
Group by: id_orig_h, id_resp_p
Source: github.com/Azure/Azure-Sentinel

'Identify scanning of services that may be available on the internal network.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rule body

id: 599570d4-06f8-4939-8e29-95cd003f1abd
name: Corelight - Network Service Scanning Multiple IP Addresses
description: |
  'Identify scanning of services that may be available on the internal network.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Corelight
    dataTypes:
      - Corelight_v2_conn
      - Corelight_v2_conn_red
      - corelight_conn
      - corelight_conn_red
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let threshold = 25;
  union corelight_conn, corelight_conn_red
  | where local_resp == true
  | where local_orig == true
  | where conn_state in~ ('S0', 'REJ')
  | where history !contains 'D'
  | summarize count() by id_orig_h, id_resp_p, bin(TimeGenerated, 1m)
  | where count_ > threshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: id_orig_h
version: 2.1.0
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 25;

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: corelight_conn, corelight_conn_red

Leg 1: `corelight_conn`

Leg 2: `corelight_conn_red`

Applied to the combined result

| where local_resp == true | where local_orig == true | where conn_state in~ ('S0', 'REJ') | where history !contains 'D' | summarize count() by id_orig_h, id_resp_p, bin(TimeGenerated, 1m) | where count_ > threshold

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`history`	contains	`D`	`excludes:history` `field:"history" value:"D"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`conn_state`	in	`REJ` `S0`	`field:"conn_state" kind:in`
`count_`	gt	`25`	`field:"count_" kind:gt value:"25"`
`local_orig`	eq	`true`	`field:"local_orig" kind:eq value:"true"`
`local_resp`	eq	`true`	`field:"local_resp" kind:eq value:"true"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`id_orig_h`	`summarize`
`id_resp_p`	`summarize`