GSA - Detect Abnormal Deny Rate for Source to Destination IP

Status: available
Severity: medium
Time window: 7d
Group by: DestinationIp, SourceIp
Source: github.com/Azure/Azure-Sentinel

Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules. Configurable Parameters: - minimumOfStdsThreshold: The number of stds to use in the threshold calculation. Default is set to 3. - learningPeriodTime: Learning period for threshold calculation in days. Default is set to 5. - binTime: Learning buckets time in hours. Default is set to 1 hour. - minimumThreshold: Minimum threshold for alert. Default is set to 5. - minimumBucketThreshold: Minimum learning buckets threshold for alert. Default is set to 5.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1571` Non-Standard Port

Rule body

id: e3b6a9e7-4c3a-45e6-8baf-1d3bfa8e0c2b
name: GSA - Detect Abnormal Deny Rate for Source to Destination IP
description: |
  Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, initial access, or C2, where an attacker tries to exploit the same vulnerability on machines in the organization but is being blocked by firewall rules.
  
  Configurable Parameters:
      - minimumOfStdsThreshold: The number of stds to use in the threshold calculation. Default is set to 3.
      - learningPeriodTime: Learning period for threshold calculation in days. Default is set to 5.
      - binTime: Learning buckets time in hours. Default is set to 1 hour.
      - minimumThreshold: Minimum threshold for alert. Default is set to 5.
      - minimumBucketThreshold: Minimum learning buckets threshold for alert. Default is set to 5.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - NetworkAccessTrafficLogs
queryFrequency: 1h
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 1
tactics:
  - InitialAccess
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1571
query: |
  let NumOfStdsThreshold = 3;
  let LearningPeriod = 5d;
  let BinTime = 1h;
  let MinThreshold = 5.0;
  let MinLearningBuckets = 5;
  let TrafficLogs = NetworkAccessTraffic
    | where Action == "Denied"
    | where isnotempty(DestinationIp) and isnotempty(SourceIp);
  let LearningSrcIpDenyRate = TrafficLogs
    | where TimeGenerated between (ago(LearningPeriod + 1d) .. ago(1d))
    | summarize count_ = count() by SourceIp, bin(TimeGenerated, BinTime), DestinationIp
    | summarize LearningTimeSrcIpDenyRateAvg = avg(count_), LearningTimeSrcIpDenyRateStd = stdev(count_), LearningTimeBuckets = count() by SourceIp, DestinationIp
    | where LearningTimeBuckets > MinLearningBuckets;
  let AlertTimeSrcIpDenyRate = TrafficLogs
    | where TimeGenerated between (ago(1h) .. now())
    | summarize AlertTimeSrcIpDenyRateCount = count() by SourceIp, DestinationIp;
  AlertTimeSrcIpDenyRate
    | join kind=leftouter (LearningSrcIpDenyRate) on SourceIp, DestinationIp
    | extend LearningThreshold = max_of(LearningTimeSrcIpDenyRateAvg + NumOfStdsThreshold * LearningTimeSrcIpDenyRateStd, MinThreshold)
    | where AlertTimeSrcIpDenyRateCount > LearningThreshold
    | project SourceIp, DestinationIp, AlertTimeSrcIpDenyRateCount, LearningThreshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: DestinationIp
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let NumOfStdsThreshold = 3;
let LearningPeriod = 5d;
let BinTime = 1h;
let MinThreshold = 5.0;
let MinLearningBuckets = 5;

let TrafficLogs and let AlertTimeSrcIpDenyRate are inlined into the numbered stages below.

Let binding: `LearningSrcIpDenyRate` used in Stage 6

let LearningSrcIpDenyRate = TrafficLogs
  | where TimeGenerated between (ago(LearningPeriod + 1d) .. ago(1d))
  | summarize count_ = count() by SourceIp, bin(TimeGenerated, BinTime), DestinationIp
  | summarize LearningTimeSrcIpDenyRateAvg = avg(count_), LearningTimeSrcIpDenyRateStd = stdev(count_), LearningTimeBuckets = count() by SourceIp, DestinationIp
  | where LearningTimeBuckets > MinLearningBuckets;

Stages 1 to 5 define let AlertTimeSrcIpDenyRate (the rule's main pipeline source); stages 6 to 9 run on it.

Stage 1: `source`

NetworkAccessTraffic

Stage 2: `where`

| where Action == "Denied"

Stage 3: `where`

| where isnotempty(DestinationIp) and isnotempty(SourceIp)

Stage 4: `where`

| where TimeGenerated between (ago(1h) .. now())

Stage 5: `summarize`

| summarize AlertTimeSrcIpDenyRateCount = count() by SourceIp, DestinationIp

Stage 6: `join`

AlertTimeSrcIpDenyRate
| join kind=leftouter (LearningSrcIpDenyRate) on SourceIp, DestinationIp

Stage 7: `extend`

| extend LearningThreshold = max_of(LearningTimeSrcIpDenyRateAvg + NumOfStdsThreshold * LearningTimeSrcIpDenyRateStd, MinThreshold)

Stage 8: `where`

| where AlertTimeSrcIpDenyRateCount > LearningThreshold

Stage 9: `project`

| project SourceIp, DestinationIp, AlertTimeSrcIpDenyRateCount, LearningThreshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`Denied`	`field:"Action" kind:eq value:"Denied"`
`AlertTimeSrcIpDenyRateCount`	cross_field_compare	`LearningThreshold` transforms: `op:gt`	`field:"AlertTimeSrcIpDenyRateCount" kind:cross_field_compare value:"LearningThreshold"`
`DestinationIp`	is_not_null	(no value, null check)	`field:"dest_ip" kind:is_not_null`
`LearningTimeBuckets`	gt	`5`	`field:"LearningTimeBuckets" kind:gt value:"5"`
`SourceIp`	is_not_null	(no value, null check)	`field:"src_ip" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertTimeSrcIpDenyRateCount`	`project`
`DestinationIp`	`project`
`LearningThreshold`	`project`
`SourceIp`	`project`

GSA - Detect Abnormal Deny Rate for Source to Destination IP

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: LearningSrcIpDenyRate used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: join

Stage 7: extend

Stage 8: where

Stage 9: project