Whisper Security - ASN Reputation Degradation | Microsoft Sentinel Analytic Rules

Back


Id	32e7bcab-4424-516e-9c7c-dbe868144494
Rulename	Whisper Security - ASN Reputation Degradation
Description	Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.
Severity	Medium
Tactics	ResourceDevelopment
Techniques	T1583
Required data connectors	WhisperSecurityConnector
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/AsnReputationDegradation.yaml
Version	1.0.0
Arm template	32e7bcab-4424-516e-9c7c-dbe868144494.json

KQL

// MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server
// Tactic: Resource Development
// Detects ASN reputation degradation (score increase > 20 points in 24h)
// Note: Higher reputationScore = worse reputation
let degradationThreshold = 20;
let currentScores = WhisperASNReputation_CL
    | where TimeGenerated > ago(1h)
    | summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn
    | project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;
let previousScores = WhisperASNReputation_CL
    | where TimeGenerated between (ago(1d) .. ago(1h))
    | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
    | project asn, PreviousScore;
currentScores
    | join kind=inner (previousScores) on asn
    | extend ScoreDelta = CurrentScore - PreviousScore
    | where ScoreDelta > degradationThreshold
    | project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount

YAML

relevantTechniques:
- T1583
queryPeriod: 1d
query: |
  // MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server
  // Tactic: Resource Development
  // Detects ASN reputation degradation (score increase > 20 points in 24h)
  // Note: Higher reputationScore = worse reputation
  let degradationThreshold = 20;
  let currentScores = WhisperASNReputation_CL
      | where TimeGenerated > ago(1h)
      | summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn
      | project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;
  let previousScores = WhisperASNReputation_CL
      | where TimeGenerated between (ago(1d) .. ago(1h))
      | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
      | project asn, PreviousScore;
  currentScores
      | join kind=inner (previousScores) on asn
      | extend ScoreDelta = CurrentScore - PreviousScore
      | where ScoreDelta > degradationThreshold
      | project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount
id: 32e7bcab-4424-516e-9c7c-dbe868144494
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: true
  createIncident: true
description: |
  Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.
kind: Scheduled
triggerOperator: gt
queryFrequency: 1h
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/AsnReputationDegradation.yaml
tactics:
- ResourceDevelopment
triggerThreshold: 0
status: Available
version: 1.0.0
requiredDataConnectors:
- connectorId: WhisperSecurityConnector
  dataTypes:
  - WhisperASNReputation_CL
name: Whisper Security - ASN Reputation Degradation
customDetails:
  OldScore: OldScore
  ASN: ASN
  NewScore: NewScore
  AsnName: AsnName
  ScoreDelta: ScoreDelta

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/32e7bcab-4424-516e-9c7c-dbe868144494')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/32e7bcab-4424-516e-9c7c-dbe868144494')]",
      "properties": {
        "alertRuleTemplateName": "32e7bcab-4424-516e-9c7c-dbe868144494",
        "customDetails": {
          "ASN": "ASN",
          "AsnName": "AsnName",
          "NewScore": "NewScore",
          "OldScore": "OldScore",
          "ScoreDelta": "ScoreDelta"
        },
        "description": "Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.\n",
        "displayName": "Whisper Security - ASN Reputation Degradation",
        "enabled": true,
        "entityMappings": null,
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Whisper/Analytic%20Rules/AsnReputationDegradation.yaml",
        "query": "// MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server\n// Tactic: Resource Development\n// Detects ASN reputation degradation (score increase > 20 points in 24h)\n// Note: Higher reputationScore = worse reputation\nlet degradationThreshold = 20;\nlet currentScores = WhisperASNReputation_CL\n    | where TimeGenerated > ago(1h)\n    | summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn\n    | project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;\nlet previousScores = WhisperASNReputation_CL\n    | where TimeGenerated between (ago(1d) .. ago(1h))\n    | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn\n    | project asn, PreviousScore;\ncurrentScores\n    | join kind=inner (previousScores) on asn\n    | extend ScoreDelta = CurrentScore - PreviousScore\n    | where ScoreDelta > degradationThreshold\n    | project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1583"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}