detection.wiki

Detection rules › Kusto

OCI - Multiple rejects on rare ports

Status
available
Severity
medium
Time window
5m
Group by
SrcIpAddr, k
Source
github.com/Azure/Azure-Sentinel

'Detects multiple rejects on rare ports.'

MITRE ATT&CK coverage

TacticTechniques
Reconnaissance

Rule body

id: 482c24b9-a700-4b2a-85d3-1c42110ba78c
name: OCI - Multiple rejects on rare ports
description: |
  'Detects multiple rejects on rare ports.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: OracleCloudInfrastructureLogsConnector
    dataTypes:
      - OCILogs
  - connectorId: OracleCloudInfraConnector
    dataTypes:
      - OCI_LogsV2_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Reconnaissance
relevantTechniques:
  - T1595
query: |
  let threshold = 50;
  let r_dports = 
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | summarize count() by DstPortNumber
  | top 10 by count_ asc
  | summarize dports = makeset(DstPortNumber)
  | extend k = 1;
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where data_action_s =~ 'REJECT'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | extend k = 1
  | join kind=innerunique (r_dports) on k
  | where dports has tostring(DstPortNumber)
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 50;

Let binding: r_dports used in Stage 7

let r_dports = OCILogs
| where EventType contains 'vcn.flowlogs'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| summarize count() by DstPortNumber
| top 10 by count_ asc
| summarize dports = makeset(DstPortNumber)
| extend k = 1;

Stage 1: source

OCILogs

Stage 2: where

| where EventType contains 'vcn.flowlogs'

Stage 3: where

| where data_action_s =~ 'REJECT'

Stage 4: where

| where ipv4_is_private(DstIpAddr)

Stage 5: where

| where ipv4_is_private(SrcIpAddr) == False

Stage 6: extend

| extend k = 1

Stage 7: join

| join kind=innerunique (r_dports) on k

Stage 8: where

| where dports has tostring(DstPortNumber)

Stage 9: summarize

| summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)

Stage 10: where

| where count_ > threshold

Stage 11: extend

| extend IPCustomEntity = SrcIpAddr

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
SrcIpAddrcidr_match10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8excludes:SrcIpAddr

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DstIpAddrcidr_match
  • 10.0.0.0/8
  • 127.0.0.0/8
  • 169.254.0.0/16
  • 172.16.0.0/12
  • 192.168.0.0/16
field:"dest_ip" kind:cidr_match
EventTypecontains
  • vcn.flowlogs
field:"EventType" kind:contains value:"vcn.flowlogs"
count_gt
  • 50
field:"count_" kind:gt value:"50"
data_action_seq
  • REJECT
field:"data_action_s" kind:eq value:"REJECT"
dportsmatch
  • DstPortNumber transforms: term
field:"dports" kind:match value:"DstPortNumber"

Output fields

These fields are emitted when the rule matches.

FieldSource
SrcIpAddrsummarize
IPCustomEntityextend