detection.wiki

Detection rules › Kusto

Ubiquiti - Unusual FTP connection to external server

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects local to remote (L2R) FTP connections.'

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1071.002 Application Layer Protocol: File Transfer Protocols
ExfiltrationT1048 Exfiltration Over Alternative Protocol

Rule body kusto

id: fd200125-9d57-4838-85ca-6430c63e4e5d
name: Ubiquiti - Unusual FTP connection to external server
description: |
  'Detects local to remote (L2R) FTP connections.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - Ubiquiti_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - CommandAndControl
relevantTechniques:
  - T1048
  - T1071.002
query: |
  let allowed_ftp = dynamic(['127.0.0.2']);
  UbiquitiAuditEvent
  | where EventCategory == 'firewall'
  | where ipv4_is_private(SrcIpAddr)
  | where ipv4_is_private(DstIpAddr) == 'False'
  | where DstPortNumber in ('20', '21')
  | where DstIpAddr !in (allowed_ftp)
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let allowed_ftp = dynamic(['127.0.0.2']);

Stage 1: source

UbiquitiAuditEvent

Stage 2: where

| where EventCategory == 'firewall'

Stage 3: where

| where ipv4_is_private(SrcIpAddr)

Stage 4: where

| where ipv4_is_private(DstIpAddr) == 'False'

Stage 5: where

| where DstPortNumber in ('20', '21')

Stage 6: where

| where DstIpAddr !in (allowed_ftp)

Stage 7: extend

| extend IPCustomEntity = SrcIpAddr

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
DstIpAddrcidr_match10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8
DstIpAddreqallowed_ftp

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DstPortNumberin
  • 20 transforms: cased
  • 21 transforms: cased
EventCategoryeq
  • firewall transforms: cased
SrcIpAddrcidr_match
  • 10.0.0.0/8
  • 127.0.0.0/8
  • 169.254.0.0/16
  • 172.16.0.0/12
  • 192.168.0.0/16

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
IPCustomEntityextend