Ubiquiti - Unusual DNS connection

Back


Id	14a23ded-7fb9-48ee-ba39-859517a49b51
Rulename	Ubiquiti - Unusual DNS connection
Description	Detects unusual remote to local (R2L) DNS connections.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1090 T1572
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiR2LDns.yaml
Version	1.0.2
Arm template	14a23ded-7fb9-48ee-ba39-859517a49b51.json

KQL

let threshold = 50;
UbiquitiAuditEvent
| where EventCategory =~ 'firewall'
| where ipv4_is_private(SrcIpAddr) == 'False'
| where ipv4_is_private(DstIpAddr)
| where DstPortNumber == '53'
| summarize count() by SrcIpAddr, DstIpAddr
| where count_ > threshold
| extend IPCustomEntity = DstIpAddr

YAML

kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
status: Available
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiR2LDns.yaml
version: 1.0.2
triggerThreshold: 0
description: |
    'Detects unusual remote to local (R2L) DNS connections.'
severity: Medium
relevantTechniques:
- T1090
- T1572
id: 14a23ded-7fb9-48ee-ba39-859517a49b51
name: Ubiquiti - Unusual DNS connection
requiredDataConnectors:
- dataTypes:
  - Ubiquiti_CL
  connectorId: CustomLogsAma
query: |
  let threshold = 50;
  UbiquitiAuditEvent
  | where EventCategory =~ 'firewall'
  | where ipv4_is_private(SrcIpAddr) == 'False'
  | where ipv4_is_private(DstIpAddr)
  | where DstPortNumber == '53'
  | summarize count() by SrcIpAddr, DstIpAddr
  | where count_ > threshold
  | extend IPCustomEntity = DstIpAddr  
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
triggerOperator: gt

ARM