detection.wiki

Detection rules › Kusto

Google Threat Intelligence - Threat Hunting IP

Severity
medium
Time window
1d
Group by
DstIpAddr, Id, ObservableValue
Source
github.com/Azure/Azure-Sentinel

Google Threat Intelligence IP correlation.

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 3: Network connection
Security-AuditingEvent ID 5152: The Windows Filtering Platform blocked a packet.
Security-AuditingEvent ID 5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-AuditingEvent ID 5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-AuditingEvent ID 5156: The Windows Filtering Platform has permitted a connection.
Security-AuditingEvent ID 5157: The Windows Filtering Platform has blocked a connection.
Security-AuditingEvent ID 5158: The Windows Filtering Platform has permitted a bind to a local port.
Security-AuditingEvent ID 5159: The Windows Filtering Platform has blocked a bind to a local port.

Rule body

id: "7edb2abb-7ef7-4685-92eb-a628703ccf9f"
name: Google Threat Intelligence - Threat Hunting IP
description: |
  'Google Threat Intelligence IP correlation.'
severity: Medium
requiredDataConnectors:
  - connectorId: ThreatIntelligence
    dataTypes:
      - ThreatIntelIndicators
queryFrequency: 30m
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Google Threat Intelligence Match'
  alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
query: |
  let ioc_lookBack = 1d;
  _Im_NetworkSession
  | where isnotempty(DstIpAddr)
  | join kind=inner (
  ThreatIntelIndicators
  | where ObservableKey == 'ipv4-addr:value'
  | where isnotempty(ObservableValue)
  | where SourceSystem == "Google Threat Intelligence"
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
  ) on $left.DstIpAddr == $right.ObservableValue
  | project NetworkIP=ObservableValue, Description=Data.description, Type, TimeGenerated
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: NetworkIP
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let ioc_lookBack = 1d;

Stage 1: source

_Im_NetworkSession

Stage 2: where

| where isnotempty(DstIpAddr)

Stage 3: join

| join kind=inner (
ThreatIntelIndicators
| where ObservableKey == 'ipv4-addr:value'
| where isnotempty(ObservableValue)
| where SourceSystem == "Google Threat Intelligence"
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
) on $left.DstIpAddr == $right.ObservableValue

Stage 4: project

| project NetworkIP=ObservableValue, Description=Data.description, Type, TimeGenerated

Stage 5: summarize aggregation inside the join branch

summarize by Id

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DstIpAddris_not_null
  • (no value, null check)
field:"dest_ip" kind:is_not_null
IsActiveeq
  • true corpus 21 (kusto 21)
field:"IsActive" kind:eq value:"true"
ObservableKeyeq
  • ipv4-addr:value corpus 12 (kusto 12)
field:"ObservableKey" kind:eq value:"ipv4-addr:value"
ObservableValueis_not_null
  • (no value, null check)
field:"ObservableValue" kind:is_not_null
SourceSystemeq
  • Google Threat Intelligence corpus 4 (kusto 4)
field:"SourceSystem" kind:eq value:"Google Threat Intelligence"
ValidUntilis_null
  • (no value, null check)
field:"ValidUntil" kind:is_null

Output fields

These fields are emitted when the rule matches.

FieldSource
Idsummarize