detection.wiki

Detection rules › Kusto

Hunt for public facing devices via DeviceNetworkEvents

Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Find public facing devices via the DeviceNetworkEvents table.

MITRE ATT&CK coverage

TacticTechniques
Initial Access

References

Telemetry coverage

PlatformRecord / event type
Microsoft Defender for EndpointDeviceNetworkEvents action InboundConnectionAccepted: Inbound connection accepted

Rule body

DeviceNetworkEvents
| where ActionType contains "InboundConnection"
| where RemoteIPType == "Public"
| distinct DeviceName

Stages and Predicates

Stage 1: source

DeviceNetworkEvents

Stage 2: where

| where ActionType contains "InboundConnection"

Stage 3: where

| where RemoteIPType == "Public"

Stage 4: distinct

| distinct DeviceName

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ActionTypecontains
  • InboundConnection
field:"ActionType" kind:contains value:"InboundConnection"
RemoteIPTypeeq
  • Public
field:"RemoteIPType" kind:eq value:"Public"