UniFi Site Manager: Console firmware likely security-relevant

Status: available
Severity: high
Time window: 6h
Group by: Id
Source: github.com/Azure/Azure-Sentinel

Identifies UniFi console / gateway devices (UDM, Cloud Key, USG, UXG, gateway) running firmware behind a major or minor version of the available release. Major/minor firmware jumps on consoles routinely include security advisory fixes (e.g. UniFi Security Advisory Bulletins). Patch-level updates are excluded since those are typically minor non-security bug fixes covered by the lower-severity FirmwareUpdateAvailable rule.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: 4f7b9e6c-5d1a-4392-8c2b-3e4f5a6b7c8d
name: "UniFi Site Manager: Console firmware likely security-relevant"
description: |
  Identifies UniFi console / gateway devices (UDM, Cloud Key, USG, UXG, gateway) running firmware behind a major or minor version of the available release. Major/minor firmware jumps on consoles routinely include security advisory fixes (e.g. UniFi Security Advisory Bulletins). Patch-level updates are excluded since those are typically minor non-security bug fixes covered by the lower-severity FirmwareUpdateAvailable rule.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Devices_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
subTechniques: []
query: |
  // Detects consoles/gateways with a major-or-minor firmware Version gap vs the available release.
  // Patch-level gaps (e.g. 5.1.11 -> 5.1.12) are excluded - covered by FirmwareUpdateAvailable at Low severity.
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(6h)
  | summarize arg_max(TimeGenerated, *) by Id
  | where IsConsole == true
  | where FirmwareStatus == "updateAvailable"
  | where isnotempty(Version) and isnotempty(UpdateAvailable)
  | extend
      currentMajor = toint(extract(@"^(\d+)\.", 1, Version)),
      currentMinor = toint(extract(@"^\d+\.(\d+)", 1, Version)),
      availableMajor = toint(extract(@"^(\d+)\.", 1, UpdateAvailable)),
      availableMinor = toint(extract(@"^\d+\.(\d+)", 1, UpdateAvailable))
  | where isnotnull(currentMajor) and isnotnull(availableMajor)
  | where (availableMajor > currentMajor) or (availableMajor == currentMajor and availableMinor > currentMinor)
  | extend GapType = iff(availableMajor > currentMajor, "major", "minor")
  | extend
      TimeGenerated = now(),
      Activity = strcat('Console ', Name, ' running ', Version, ' - likely security-relevant ', GapType, ' update available to ', UpdateAvailable)
  | project
      TimeGenerated,
      DeviceId = Id,
      DeviceName = Name,
      Model = Model,
      ProductLine = ProductLine,
      CurrentVersion = Version,
      AvailableVersion = UpdateAvailable,
      GapType,
      Activity
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
      - identifier: NetBiosName
        columnName: DeviceId
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Devices_CL

Stage 2: `where`

| where TimeGenerated > ago(6h)

Stage 3: `summarize`

| summarize arg_max(TimeGenerated, *) by Id

Stage 4: `where`

| where IsConsole == true

Stage 5: `where`

| where FirmwareStatus == "updateAvailable"

Stage 6: `where`

| where isnotempty(Version) and isnotempty(UpdateAvailable)

Stage 7: `extend`

| extend
    currentMajor = toint(extract(@"^(\d+)\.", 1, Version)),
    currentMinor = toint(extract(@"^\d+\.(\d+)", 1, Version)),
    availableMajor = toint(extract(@"^(\d+)\.", 1, UpdateAvailable)),
    availableMinor = toint(extract(@"^\d+\.(\d+)", 1, UpdateAvailable))

Stage 8: `where`

| where isnotnull(currentMajor) and isnotnull(availableMajor)

Stage 9: `where`

| where (availableMajor > currentMajor) or (availableMajor == currentMajor and availableMinor > currentMinor)

Stage 10: `extend`

| extend GapType = iff(availableMajor > currentMajor, "major", "minor")

GapType =

ifavailableMajor > currentMajor"major"

else"minor"

Stage 11: `extend`

| extend
    TimeGenerated = now(),
    Activity = strcat('Console ', Name, ' running ', Version, ' - likely security-relevant ', GapType, ' update available to ', UpdateAvailable)

Stage 12: `project`

| project
    TimeGenerated,
    DeviceId = Id,
    DeviceName = Name,
    Model = Model,
    ProductLine = ProductLine,
    CurrentVersion = Version,
    AvailableVersion = UpdateAvailable,
    GapType,
    Activity

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FirmwareStatus`	eq	`updateAvailable`	`field:"FirmwareStatus" kind:eq value:"updateAvailable"`
`IsConsole`	eq	`true`	`field:"IsConsole" kind:eq value:"true"`
`UpdateAvailable`	is_not_null	(no value, null check)	`field:"UpdateAvailable" kind:is_not_null`
`Version`	is_not_null	(no value, null check)	`field:"Version" kind:is_not_null`
`availableMajor`	cross_field_compare	`currentMajor` transforms: `op:gt`	`field:"availableMajor" kind:cross_field_compare value:"currentMajor"`
`availableMajor`	is_not_null	(no value, null check)	`field:"availableMajor" kind:is_not_null`
`availableMinor`	cross_field_compare	`currentMinor` transforms: `op:gt`	`field:"availableMinor" kind:cross_field_compare value:"currentMinor"`
`currentMajor`	is_not_null	(no value, null check)	`field:"currentMajor" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Activity`	`project`
`AvailableVersion`	`project`
`CurrentVersion`	`project`
`DeviceId`	`project`
`DeviceName`	`project`
`GapType`	`project`
`Model`	`project`
`ProductLine`	`project`
`TimeGenerated`	`project`

UniFi Site Manager: Console firmware likely security-relevant

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: extend

Stage 8: where

Stage 9: where

Stage 10: extend

Stage 11: extend

Stage 12: project