MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: 31e868c0-91d3-40eb-accc-3fa73aa96f8e
name: Ubiquiti - Unusual traffic
description: |
'Detects unusual traffic masking as HTTP(S).'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CustomLogsAma
dataTypes:
- Ubiquiti_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
relevantTechniques:
- T1573
query: |
UbiquitiAuditEvent
| where EventCategory =~ 'firewall'
| where DstPortNumber in ('80', '443')
| where NetworkProtocol !~ 'TCP'
| extend IPCustomEntity = SrcIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.3
kind: Scheduled
Stages and Predicates
Stage 1: source
UbiquitiAuditEvent
Stage 2: where
| where EventCategory =~ 'firewall'
Stage 3: where
| where DstPortNumber in ('80', '443')
Stage 4: where
| where NetworkProtocol !~ 'TCP'
Stage 5: extend
| extend IPCustomEntity = SrcIpAddr
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DstPortNumber | in |
| field:"DstPortNumber" kind:in |
EventCategory | eq |
| field:"EventCategory" kind:eq value:"firewall" |
NetworkProtocol | ne |
| field:"NetworkProtocol" kind:ne value:"TCP" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
IPCustomEntity | extend |