Ubiquiti - Unknown MAC Joined AP

Status: available
Severity: medium
Time window: 14d
Source: github.com/Azure/Azure-Sentinel

'Detects when device with unseen MAC Address joined AP.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services

Rule body

id: 9757cee3-1a6c-4d8e-a968-3b7e48ded690
name: Ubiquiti - Unknown MAC Joined AP
description: |
  'Detects when device with unseen MAC Address joined AP.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - Ubiquiti_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1133
query: |
  let lbperiod = 14d;
  let lbperiod_24h = 24h;
  let known_macs = UbiquitiAuditEvent
  | where TimeGenerated between (ago(lbperiod) .. ago(lbperiod_24h))
  | where DvcAction =~ 'JOIN'
  | summarize makeset(SrcMacAddr);
  UbiquitiAuditEvent
  | where DvcAction =~ 'JOIN'
  | where SrcMacAddr !in (known_macs)
  | extend Device = SrcMacAddr
  | extend HostCustomEntity = Device
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let lbperiod = 14d;
let lbperiod_24h = 24h;

Let binding: `known_macs` used in Stage 3

let known_macs = UbiquitiAuditEvent
| where TimeGenerated between (ago(lbperiod) .. ago(lbperiod_24h))
| where DvcAction =~ 'JOIN'
| summarize makeset(SrcMacAddr);

Stage 1: `source`

UbiquitiAuditEvent

Stage 2: `where`

| where DvcAction =~ 'JOIN'

Stage 3: `where`

| where SrcMacAddr !in (known_macs)

Stage 4: `extend`

| extend Device = SrcMacAddr

Stage 5: `extend`

| extend HostCustomEntity = Device

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SrcMacAddr`	eq	`known_macs`	`excludes:SrcMacAddr` `field:"SrcMacAddr" value:"known_macs"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DvcAction`	eq	`JOIN`	`field:"DvcAction" kind:eq value:"JOIN"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Device`	`extend`
`HostCustomEntity`	`extend`