detection.wiki

Detection rules › Kusto

Ubiquiti - Possible connection to cryptominning pool

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects connections which may indicate that device is infected with cryptominer.'

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1071 Application Layer Protocol, T1095 Non-Application Layer Protocol, T1571 Non-Standard Port

Rule body kusto

id: 7feb3c32-2a11-4eb8-a2d7-e3792b31cb80
name: Ubiquiti - Possible connection to cryptominning pool
description: |
  'Detects connections which may indicate that device is infected with cryptominer.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - Ubiquiti_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
  - T1095
  - T1571
query: |
  let susp_dst_ports = dynamic(['14433', '14444', '3333', '3334', '3335', '3336', '4444', '45560', '45700', '5555', '5556', '6666', '7777', '8788', '8888', '8899', '9999', '10034']);
  UbiquitiAuditEvent
  | where ipv4_is_private(SrcIpAddr)
  | where ipv4_is_private(DstIpAddr) == 'False'
  | where DstPortNumber in (susp_dst_ports)  or (DnsQuery contains 'pool' and DnsQuery contains 'xmr')
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: susp_dst_ports

let susp_dst_ports = dynamic(['14433', '14444', '3333', '3334', '3335', '3336', '4444', '45560', '45700', '5555', '5556', '6666', '7777', '8788', '8888', '8899', '9999', '10034']);

Stage 1: source

UbiquitiAuditEvent

Stage 2: where

| where ipv4_is_private(SrcIpAddr)

Stage 3: where

| where ipv4_is_private(DstIpAddr) == 'False'

Stage 4: where

| where DstPortNumber in (susp_dst_ports)  or (DnsQuery contains 'pool' and DnsQuery contains 'xmr')

References susp_dst_ports (defined above).

Stage 5: extend

| extend IPCustomEntity = SrcIpAddr

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
DstIpAddrcidr_match10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DnsQuerycontains
  • pool
  • xmr
DstPortNumberin
  • 10034 transforms: cased
  • 14433 transforms: cased
  • 14444 transforms: cased
  • 3333 transforms: cased
  • 3334 transforms: cased
  • 3335 transforms: cased
  • 3336 transforms: cased
  • 4444 transforms: cased
  • 45560 transforms: cased
  • 45700 transforms: cased
  • 5555 transforms: cased
  • 5556 transforms: cased
  • 6666 transforms: cased
  • 7777 transforms: cased
  • 8788 transforms: cased
  • 8888 transforms: cased
  • 8899 transforms: cased
  • 9999 transforms: cased
SrcIpAddrcidr_match
  • 10.0.0.0/8
  • 127.0.0.0/8
  • 169.254.0.0/16
  • 172.16.0.0/12
  • 192.168.0.0/16

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
IPCustomEntityextend