SonicWall - Allowed SSH Telnet and RDP Connections

Back


Id	27f1a570-5f20-496b-88f6-a9aa2c5c9534
Rulename	SonicWall - Allowed SSH, Telnet, and RDP Connections
Description	This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).
Severity	Medium
Tactics	InitialAccess Execution Persistence CredentialAccess Discovery LateralMovement Collection Exfiltration Impact
Techniques	T1190 T1133 T1059 T1133 T1110 T1003 T1087 T1018 T1021 T1005 T1048 T1041 T1011 T1567 T1490
Required data connectors	CEF CefAma SonicWallFirewall
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonicWall Firewall/Analytic Rules/AllowedInboundSSHTelnetRDPConnections.yaml
Version	1.0.1
Arm template	27f1a570-5f20-496b-88f6-a9aa2c5c9534.json

KQL

ASimNetworkSessionSonicWallFirewall(false)
| where NetworkDirection == "Inbound" and EventResult in ("NA", "Success")
| where EventOriginalType != 1370
| where SrcAppName contains "Windows Remote Desktop Services"
    or SrcAppName contains "Telnet"
    or (SrcAppName contains "SSH Protocol" and ThreatId != 446) // Filters out SSH server responses.
    or SrcAppName contains "Bitvise SSH"
    or DstPortNumber in (22, 23, 3389)

YAML

description: |
    'This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).'
version: 1.0.1
triggerThreshold: 0
tactics:
- InitialAccess
- Execution
- Persistence
- CredentialAccess
- Discovery
- LateralMovement
- Collection
- Exfiltration
- Impact
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonicWall Firewall/Analytic Rules/AllowedInboundSSHTelnetRDPConnections.yaml
triggerOperator: gt
status: Experimental
id: 27f1a570-5f20-496b-88f6-a9aa2c5c9534
name: SonicWall - Allowed SSH, Telnet, and RDP Connections
queryFrequency: 1h
severity: Medium
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: DstIpAddr
    identifier: Address
  entityType: IP
relevantTechniques:
- T1190
- T1133
- T1059
- T1133
- T1110
- T1003
- T1087
- T1018
- T1021
- T1005
- T1048
- T1041
- T1011
- T1567
- T1490
query: |
  ASimNetworkSessionSonicWallFirewall(false)
  | where NetworkDirection == "Inbound" and EventResult in ("NA", "Success")
  | where EventOriginalType != 1370
  | where SrcAppName contains "Windows Remote Desktop Services"
      or SrcAppName contains "Telnet"
      or (SrcAppName contains "SSH Protocol" and ThreatId != 446) // Filters out SSH server responses.
      or SrcAppName contains "Bitvise SSH"
      or DstPortNumber in (22, 23, 3389)  
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CEF
- dataTypes:
  - ASimNetworkSessionSonicWallFirewall
  connectorId: SonicWallFirewall
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma

ARM