OCI - Multiple rejects on rare ports

Back


Id	482c24b9-a700-4b2a-85d3-1c42110ba78c
Rulename	OCI - Multiple rejects on rare ports
Description	Detects multiple rejects on rare ports.
Severity	Medium
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	OracleCloudInfrastructureLogsConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleRejects.yaml
Version	1.0.0
Arm template	482c24b9-a700-4b2a-85d3-1c42110ba78c.json

KQL

let threshold = 50;
let r_dports = 
OCILogs
| where EventType contains 'vcn.flowlogs'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| summarize count() by DstPortNumber
| top 10 by count_ asc
| summarize dports = makeset(DstPortNumber)
| extend k = 1;
OCILogs
| where EventType contains 'vcn.flowlogs'
| where data_action_s =~ 'REJECT'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| extend k = 1
| join kind=innerunique (r_dports) on k
| where dports has tostring(DstPortNumber)
| summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects multiple rejects on rare ports.'
kind: Scheduled
tactics:
- Reconnaissance
requiredDataConnectors:
- connectorId: OracleCloudInfrastructureLogsConnector
  dataTypes:
  - OCILogs
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleRejects.yaml
severity: Medium
name: OCI - Multiple rejects on rare ports
triggerThreshold: 0
queryPeriod: 14d
query: |
  let threshold = 50;
  let r_dports = 
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | summarize count() by DstPortNumber
  | top 10 by count_ asc
  | summarize dports = makeset(DstPortNumber)
  | extend k = 1;
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where data_action_s =~ 'REJECT'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | extend k = 1
  | join kind=innerunique (r_dports) on k
  | where dports has tostring(DstPortNumber)
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
relevantTechniques:
- T1595
id: 482c24b9-a700-4b2a-85d3-1c42110ba78c
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.0
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address

ARM