Hunt for public facing devices via public tag

Group by: DeviceName, InternetFacingLocalIp, InternetFacingLocalPort, InternetFacingPublicScannedIp, InternetFacingPublicScannedPort, InternetFacingReason, InternetFacingTransportProtocol
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Find public facing devices via the public device tag in the DeviceInfo table. The internet facing reason is also included in this query.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

References

https://hybridbrothers.com/analyzing-mde-network-inspections/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceInfo` action `any`: Device information

Rule body

DeviceInfo
| where Timestamp > ago(7d)
| extend AdditionalFields = todynamic(AdditionalFields)
| where todatetime(AdditionalFields.InternetFacingLastSeen) > ago(7d)
| extend InternetFacingLastSeen = tostring(AdditionalFields.InternetFacingLastSeen)
    , InternetFacingReason = tostring(AdditionalFields.InternetFacingReason)
    , InternetFacingLocalIp = tostring(AdditionalFields.InternetFacingLocalIp)
    , InternetFacingPublicScannedIp = tostring(AdditionalFields.InternetFacingPublicScannedIp)
    , InternetFacingLocalPort = tostring(AdditionalFields.InternetFacingLocalPort)
    , InternetFacingPublicScannedPort = tostring(AdditionalFields.InternetFacingPublicScannedPort)
    , InternetFacingTransportProtocol = tostring(AdditionalFields.InternetFacingTransportProtocol)
| summarize arg_max(InternetFacingLastSeen, *) by DeviceName, InternetFacingLocalIp, InternetFacingLocalPort, InternetFacingPublicScannedIp, InternetFacingPublicScannedPort, InternetFacingTransportProtocol, InternetFacingReason
| project InternetFacingLastSeen, DeviceName, InternetFacingLocalIp, InternetFacingLocalPort, InternetFacingPublicScannedIp, InternetFacingPublicScannedPort, InternetFacingTransportProtocol, InternetFacingReason

Stages and Predicates

Stage 1: `source`

DeviceInfo

Stage 2: `where`

| where Timestamp > ago(7d)

Stage 3: `extend`

| extend AdditionalFields = todynamic(AdditionalFields)

Stage 4: `where`

| where todatetime(AdditionalFields.InternetFacingLastSeen) > ago(7d)

Stage 5: `extend`

| extend InternetFacingLastSeen = tostring(AdditionalFields.InternetFacingLastSeen)
    , InternetFacingReason = tostring(AdditionalFields.InternetFacingReason)
    , InternetFacingLocalIp = tostring(AdditionalFields.InternetFacingLocalIp)
    , InternetFacingPublicScannedIp = tostring(AdditionalFields.InternetFacingPublicScannedIp)
    , InternetFacingLocalPort = tostring(AdditionalFields.InternetFacingLocalPort)
    , InternetFacingPublicScannedPort = tostring(AdditionalFields.InternetFacingPublicScannedPort)
    , InternetFacingTransportProtocol = tostring(AdditionalFields.InternetFacingTransportProtocol)

Stage 6: `summarize`

| summarize arg_max(InternetFacingLastSeen, *) by DeviceName, InternetFacingLocalIp, InternetFacingLocalPort, InternetFacingPublicScannedIp, InternetFacingPublicScannedPort, InternetFacingTransportProtocol, InternetFacingReason

Stage 7: `project`

| project InternetFacingLastSeen, DeviceName, InternetFacingLocalIp, InternetFacingLocalPort, InternetFacingPublicScannedIp, InternetFacingPublicScannedPort, InternetFacingTransportProtocol, InternetFacingReason

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceName`	`project`
`InternetFacingLastSeen`	`project`
`InternetFacingLocalIp`	`project`
`InternetFacingLocalPort`	`project`
`InternetFacingPublicScannedIp`	`project`
`InternetFacingPublicScannedPort`	`project`
`InternetFacingReason`	`project`
`InternetFacingTransportProtocol`	`project`

Hunt for public facing devices via public tag

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where

Stage 5: extend

Stage 6: summarize

Stage 7: project

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `extend`

Stage 4: `where`

Stage 5: `extend`

Stage 6: `summarize`

Stage 7: `project`