PaloAlto - MAC address conflict

Status: available
Severity: low
Time window: 1h
Group by: DestinationMACAddress
Source: github.com/Azure/Azure-Sentinel

'Detects several users with the same MAC address.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: 976d2eee-51cb-11ec-bf63-0242ac130002
name: PaloAlto - MAC address conflict
description: |
  'Detects several users with the same MAC address.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let threshold = 2;
  PaloAltoCDLEvent
  | where EventResourceId =~ 'TRAFFIC'
  | where isnotempty(DestinationMACAddress) and isnotempty(DstUsername)
  | summarize UserSet = make_set(DstUsername) by DestinationMACAddress
  | extend Users = array_length(UserSet)
  | where Users >= threshold
  | extend AccountCustomEntity = UserSet, IPCustomEntity = DestinationMACAddress
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 2;

Stage 1: `source`

PaloAltoCDLEvent

Stage 2: `where`

| where EventResourceId =~ 'TRAFFIC'

Stage 3: `where`

| where isnotempty(DestinationMACAddress) and isnotempty(DstUsername)

Stage 4: `summarize`

| summarize UserSet = make_set(DstUsername) by DestinationMACAddress

Stage 5: `extend`

| extend Users = array_length(UserSet)

Stage 6: `where`

| where Users >= threshold

Stage 7: `extend`

| extend AccountCustomEntity = UserSet, IPCustomEntity = DestinationMACAddress

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DestinationMACAddress`	is_not_null	(no value, null check)	`field:"DestinationMACAddress" kind:is_not_null`
`DstUsername`	is_not_null	(no value, null check)	`field:"DstUsername" kind:is_not_null`
`EventResourceId`	eq	`TRAFFIC`	`field:"EventResourceId" kind:eq value:"TRAFFIC"`
`Users`	ge	`2`	`field:"Users" kind:ge value:"2"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DestinationMACAddress`	`summarize`
`UserSet`	`summarize`
`Users`	`extend`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

PaloAlto - MAC address conflict

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: extend

Stage 6: where

Stage 7: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `summarize`

Stage 5: `extend`

Stage 6: `where`

Stage 7: `extend`