Internet Access (Microsoft Defender for IoT)

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'This alert leverages Defender for IoT to detect an OT device communicating with Internet which is possibly an indication of improper configuration of an application or malicious activity on the network.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T0886` Remote Services
Lateral Movement	`T0886` Remote Services

Rule body

id: 9ff3b13b-287a-4ed0-8f6b-7e7b66cbbcbd
name: Internet Access (Microsoft Defender for IoT)
description: |
  'This alert leverages Defender for IoT to detect an OT device communicating with Internet which is possibly an indication of improper configuration of an application or malicious activity on the network.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: IoT
    dataTypes:
      - SecurityAlert (ASC for IoT)
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T0886
query: |
  SecurityAlert
  | where ProviderName == "IoTSecurity"
  | where AlertName has "Internet"
  | extend ExtendedProperties = parse_json(ExtendedProperties)
  | where tostring(ExtendedProperties.isNew) == "True"
  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
           Protocol = tostring(ExtendedProperties.Protocol), 
           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
  | project
    TimeGenerated,
    DeviceId,
    ProductName,
    ProductComponentName,
    AlertSeverity,
    AlertName,
    Description,
    Protocol,
    SourceDeviceAddress,
    DestDeviceAddress,
    RemediationSteps,
    Tactics,
    Entities,
    VendorOriginalId,
    AlertLink,
    AlertManagementUri,
    Techniques
entityMappings:
sentinelEntitiesMappings:
  - columnName: Entities
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  Sensor: DeviceId
  Protocol: Protocol
  VendorOriginalId: VendorOriginalId
  AlertManagementUri: AlertManagementUri
alertDetailsOverride:
  alertDisplayNameFormat: (MDIoT) {{AlertName}}
  alertDescriptionFormat: (MDIoT) {{Description}}
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: AlertSeverity
  alertDynamicProperties: 
    - alertProperty: ProductName
      value: ProductName
    - alertProperty: RemediationSteps
      value: RemediationSteps
    - alertProperty: Techniques
      value: Techniques
    - alertProperty: ProductComponentName
      value: ProductComponentName
    - alertProperty: AlertLink
      value: AlertLink
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityAlert

Stage 2: `where`

| where ProviderName == "IoTSecurity"

Stage 3: `where`

| where AlertName has "Internet"

Stage 4: `extend`

| extend ExtendedProperties = parse_json(ExtendedProperties)

Stage 5: `where`

| where tostring(ExtendedProperties.isNew) == "True"

Stage 6: `extend`

| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)

Stage 7: `project`

| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AlertName`	match	`Internet` transforms: `term`	`field:"AlertName" kind:match value:"Internet"`
`ProviderName`	eq	`IoTSecurity`	`field:"ProviderName" kind:eq value:"IoTSecurity"`
`isNew`	eq	`True` transforms: `tostring`	`field:"isNew" kind:eq value:"True"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertLink`	`project`
`AlertManagementUri`	`project`
`AlertName`	`project`
`AlertSeverity`	`project`
`Description`	`project`
`DestDeviceAddress`	`project`
`DeviceId`	`project`
`Entities`	`project`
`ProductComponentName`	`project`
`ProductName`	`project`
`Protocol`	`project`
`RemediationSteps`	`project`
`SourceDeviceAddress`	`project`
`Tactics`	`project`
`Techniques`	`project`
`TimeGenerated`	`project`
`VendorOriginalId`	`project`

Internet Access (Microsoft Defender for IoT)

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: extend

Stage 7: project