detection.wiki

Detection rules › Kusto

Ubiquiti - Connection to known malicious IP or C2

Status
available
Severity
medium
Time window
14d
Source
github.com/Azure/Azure-Sentinel

'Detects allowed connections to IP addresses which are in TI list and are known to be malicious.'

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1071 Application Layer Protocol, T1571 Non-Standard Port, T1572 Protocol Tunneling

Rule body kusto

id: db60ca0b-b668-439b-b889-b63b57ef20fb
name: Ubiquiti - Connection to known malicious IP or C2
description: |
  'Detects allowed connections to IP addresses which are in TI list and are known to be malicious.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - Ubiquiti_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1071
  - T1571
  - T1572
query: |
  let malicious_ips =
  ThreatIntelligenceIndicator
  | where isnotempty(NetworkIP)
  | summarize make_list(NetworkIP);
  UbiquitiAuditEvent
  | where EventCategory =~ 'firewall'
  | where ipv4_is_private(SrcIpAddr)
  | where ipv4_is_private(DstIpAddr) == 'False'
  | where DstIpAddr in (malicious_ips)
  | where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: malicious_ips

let malicious_ips = ThreatIntelligenceIndicator
| where isnotempty(NetworkIP)
| summarize make_list(NetworkIP);

Stage 1: source

UbiquitiAuditEvent

Stage 2: where

| where EventCategory =~ 'firewall'

Stage 3: where

| where ipv4_is_private(SrcIpAddr)

Stage 4: where

| where ipv4_is_private(DstIpAddr) == 'False'

Stage 5: where

| where DstIpAddr in (malicious_ips)

References malicious_ips (defined above).

Stage 6: where

| where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'

Stage 7: extend

| extend IPCustomEntity = SrcIpAddr

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
DstIpAddrcidr_match10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DstIpAddrin
  • malicious_ips transforms: cased
DvcActioneq
  • Accepted
  • Other
EventCategoryeq
  • firewall
SrcIpAddrcidr_match
  • 10.0.0.0/8
  • 127.0.0.0/8
  • 169.254.0.0/16
  • 172.16.0.0/12
  • 192.168.0.0/16

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
IPCustomEntityextend