detection.wiki

Detection rules › Kusto

GSA - TI IP Entity

Status
available
Severity
medium
Time window
14d
Group by
DestinationIp, Id, TI_ipEntity
Source
github.com/Azure/Azure-Sentinel

This query identifies IP indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

id: 3ebd25b1-6f54-49f9-b5a5-0246357ce4ca
name: GSA - TI IP Entity
description: |
  This query identifies IP indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - NetworkAccessTrafficLogs
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let NetworkAccessTraffic_ =
      NetworkAccessTraffic
      | where TimeGenerated >= ago(dt_lookBack)
      | where TrafficType == "internet"
      | project-rename GSANetworkAccessTraffic_TimeGenerated = TimeGenerated;
  let IPList = NetworkAccessTraffic_ | summarize by DestinationIp;
  ThreatIntelIndicators
  | project-rename TI_ipEntity = ObservableValue
  | extend IndicatorType = replace(@'\[|\]|"""', "", tostring(split(ObservableKey, ":", 0)))
  | where IndicatorType in ("ipv4-addr", "network-traffic")
  | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
  | where TimeGenerated >= ago(ioc_lookBack)
  | where TI_ipEntity in (IPList)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, TI_ipEntity
  | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
  | extend Description = tostring(parse_json(Data).description)
  | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"
  | join kind=innerunique (NetworkAccessTraffic_) on $left.TI_ipEntity == $right.DestinationIp
  | extend GSAThreatType = ThreatType
  | summarize GSANetworkAccessTraffic_TimeGenerated = arg_max(GSANetworkAccessTraffic_TimeGenerated, *) by Id, DestinationIp
  | project-reorder *,
      Tags,
      Confidence,
      TrafficLightProtocolLevel,
      Type,
      TI_ipEntity,
      UserPrincipalName,
      UserId,
      DeviceId,
      InitiatingProcessName,
      GSAThreatType,
      DestinationFqdn,
      DestinationUrl,
      DestinationPort,
      SourceIp,
      SourcePort,
      HttpUserAgent
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: UserPrincipalName
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: InitiatingProcessName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIp
  - entityType: Host
    fieldMappings:
      - identifier: AzureID
        columnName: DeviceId
kind: Scheduled

Stages and Predicates

Parameters

let dt_lookBack = 1h;
let ioc_lookBack = 14d;

Let binding: NetworkAccessTraffic_ used in Stage 12

let NetworkAccessTraffic_ = NetworkAccessTraffic
    | where TimeGenerated >= ago(dt_lookBack)
    | where TrafficType == "internet"
    | project-rename GSANetworkAccessTraffic_TimeGenerated = TimeGenerated;

Let binding: IPList used in Stage 7

let IPList = NetworkAccessTraffic_ | summarize by DestinationIp;

Stage 1: source

ThreatIntelIndicators

Stage 2: project-rename

| project-rename TI_ipEntity = ObservableValue

Stage 3: extend

| extend IndicatorType = replace(@'\[|\]|"""', "", tostring(split(ObservableKey, ":", 0)))

Stage 4: where

| where IndicatorType in ("ipv4-addr", "network-traffic")

Stage 5: extend

| extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)

Stage 6: where

| where TimeGenerated >= ago(ioc_lookBack)

Stage 7: where

| where TI_ipEntity in (IPList)

Stage 8: summarize

| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, TI_ipEntity

Stage 9: where

| where IsActive and (ValidUntil > now() or isempty(ValidUntil))

Stage 10: extend

| extend Description = tostring(parse_json(Data).description)

Stage 11: where

| where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;"

Stage 12: join

| join kind=innerunique (NetworkAccessTraffic_) on $left.TI_ipEntity == $right.DestinationIp

Stage 13: extend

| extend GSAThreatType = ThreatType

Stage 14: summarize

| summarize GSANetworkAccessTraffic_TimeGenerated = arg_max(GSANetworkAccessTraffic_TimeGenerated, *) by Id, DestinationIp

Stage 15: project-reorder

| project-reorder *,
    Tags,
    Confidence,
    TrafficLightProtocolLevel,
    Type,
    TI_ipEntity,
    UserPrincipalName,
    UserId,
    DeviceId,
    InitiatingProcessName,
    GSAThreatType,
    DestinationFqdn,
    DestinationUrl,
    DestinationPort,
    SourceIp,
    SourcePort,
    HttpUserAgent

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
DescriptioncontainsState: falsepos;excludes:Description field:"Description" value:"State: falsepos;"
DescriptioncontainsState: inactive;excludes:Description field:"Description" value:"State: inactive;"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
IndicatorTypein
  • ipv4-addr
  • network-traffic
field:"IndicatorType" kind:in
TI_ipEntityin
  • IPList
field:"TI_ipEntity" kind:in value:"IPList"
TrafficTypeeq
  • internet
field:"TrafficType" kind:eq value:"internet"
ValidUntilis_null
  • (no value, null check)
field:"ValidUntil" kind:is_null

Output fields

These fields are emitted when the rule matches.

FieldSource
DestinationIpsummarize
GSANetworkAccessTraffic_TimeGeneratedsummarize
Idsummarize