Ubiquiti - Unusual DNS connection

Back


Id	14a23ded-7fb9-48ee-ba39-859517a49b51
Rulename	Ubiquiti - Unusual DNS connection
Description	Detects unusual remote to local (R2L) DNS connections.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1090 T1572
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiR2LDns.yaml
Version	1.0.2
Arm template	14a23ded-7fb9-48ee-ba39-859517a49b51.json

KQL

let threshold = 50;
UbiquitiAuditEvent
| where EventCategory =~ 'firewall'
| where ipv4_is_private(SrcIpAddr) == 'False'
| where ipv4_is_private(DstIpAddr)
| where DstPortNumber == '53'
| summarize count() by SrcIpAddr, DstIpAddr
| where count_ > threshold
| extend IPCustomEntity = DstIpAddr

YAML

queryPeriod: 1h
query: |
  let threshold = 50;
  UbiquitiAuditEvent
  | where EventCategory =~ 'firewall'
  | where ipv4_is_private(SrcIpAddr) == 'False'
  | where ipv4_is_private(DstIpAddr)
  | where DstPortNumber == '53'
  | summarize count() by SrcIpAddr, DstIpAddr
  | where count_ > threshold
  | extend IPCustomEntity = DstIpAddr  
name: Ubiquiti - Unusual DNS connection
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiR2LDns.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - Ubiquiti_CL
description: |
    'Detects unusual remote to local (R2L) DNS connections.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1090
- T1572
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
id: 14a23ded-7fb9-48ee-ba39-859517a49b51

ARM