Multiple Sources Affected by the Same TI Destination

Back


Id	4644baf7-3464-45dd-bd9d-e07687e25f81
Rulename	Multiple Sources Affected by the Same TI Destination
Description	Identifies multiple machines trying to reach out to the same destination blocked by TI in Azure Firewall. This can indicate attack on the organization by the same attack group. Configurable Parameters: - Minimum affected threshold - alert only if more than this number of hosts affected. Default is set to 5. - Recommendation is to use the new resource specific logs. If you are using both, the TiTraffic Count will be duplicated.
Severity	Medium
Tactics	Exfiltration CommandAndControl
Techniques	T1041 T1071
Required data connectors	AzureFirewall
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	1
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml
Version	1.1.4
Arm template	4644baf7-3464-45dd-bd9d-e07687e25f81.json

KQL

let RunTime = 1d; 
let StartRunTime = 1d; 
let EndRunTime = StartRunTime - RunTime; 
let MinAffectedThreshold = 5;
union isfuzzy=true
(AzureDiagnostics 
| where TimeGenerated  between (ago(StartRunTime) .. ago(EndRunTime))
| where OperationName == "AzureFirewallThreatIntelLog"
| parse msg_s with * "from " SourceIp ":" SourcePort:int " to " Fqdn ":" DestinationPort:int  "." * "Action: Deny. " ThreatDescription),
(AZFWThreatIntel
| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime)))
| extend Fqdn = DestinationIp
| summarize TiTrafficCount = count(), dCountSourceIps = dcount(SourceIp), AffectedIps = make_set(SourceIp, 10000) by Fqdn, ThreatDescription
| where array_length(AffectedIps) > MinAffectedThreshold
| mv-expand SourceIp = AffectedIps
| order by TiTrafficCount desc, Fqdn asc, parse_ipv4(tostring(SourceIp)) asc

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml
severity: Medium
queryFrequency: 1d
status: Available
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIp
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: Fqdn
  entityType: URL
triggerOperator: gt
query: |
  let RunTime = 1d; 
  let StartRunTime = 1d; 
  let EndRunTime = StartRunTime - RunTime; 
  let MinAffectedThreshold = 5;
  union isfuzzy=true
  (AzureDiagnostics 
  | where TimeGenerated  between (ago(StartRunTime) .. ago(EndRunTime))
  | where OperationName == "AzureFirewallThreatIntelLog"
  | parse msg_s with * "from " SourceIp ":" SourcePort:int " to " Fqdn ":" DestinationPort:int  "." * "Action: Deny. " ThreatDescription),
  (AZFWThreatIntel
  | where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime)))
  | extend Fqdn = DestinationIp
  | summarize TiTrafficCount = count(), dCountSourceIps = dcount(SourceIp), AffectedIps = make_set(SourceIp, 10000) by Fqdn, ThreatDescription
  | where array_length(AffectedIps) > MinAffectedThreshold
  | mv-expand SourceIp = AffectedIps
  | order by TiTrafficCount desc, Fqdn asc, parse_ipv4(tostring(SourceIp)) asc  
queryPeriod: 1d
kind: Scheduled
id: 4644baf7-3464-45dd-bd9d-e07687e25f81
relevantTechniques:
- T1041
- T1071
description: |
  'Identifies multiple machines trying to reach out to the same destination blocked by TI in Azure Firewall. This can indicate attack on the organization by the same attack group.

  Configurable Parameters:

  - Minimum affected threshold - alert only if more than this number of hosts affected. Default is set to 5.
  - Recommendation is to use the new resource specific logs. If you are using both, the TiTraffic Count will be duplicated.'  
requiredDataConnectors:
- dataTypes:
  - AzureDiagnostics
  - AZFWThreatIntel
  connectorId: AzureFirewall
triggerThreshold: 1
tactics:
- Exfiltration
- CommandAndControl
name: Multiple Sources Affected by the Same TI Destination
version: 1.1.4

ARM