OCI - Multiple rejects on rare ports

Back


Id	482c24b9-a700-4b2a-85d3-1c42110ba78c
Rulename	OCI - Multiple rejects on rare ports
Description	Detects multiple rejects on rare ports.
Severity	Medium
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	OracleCloudInfrastructureLogsConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleRejects.yaml
Version	1.0.0
Arm template	482c24b9-a700-4b2a-85d3-1c42110ba78c.json

KQL

let threshold = 50;
let r_dports = 
OCILogs
| where EventType contains 'vcn.flowlogs'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| summarize count() by DstPortNumber
| top 10 by count_ asc
| summarize dports = makeset(DstPortNumber)
| extend k = 1;
OCILogs
| where EventType contains 'vcn.flowlogs'
| where data_action_s =~ 'REJECT'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| extend k = 1
| join kind=innerunique (r_dports) on k
| where dports has tostring(DstPortNumber)
| summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects multiple rejects on rare ports.'
version: 1.0.0
tactics:
- Reconnaissance
queryFrequency: 1h
query: |
  let threshold = 50;
  let r_dports = 
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | summarize count() by DstPortNumber
  | top 10 by count_ asc
  | summarize dports = makeset(DstPortNumber)
  | extend k = 1;
  OCILogs
  | where EventType contains 'vcn.flowlogs'
  | where data_action_s =~ 'REJECT'
  | where ipv4_is_private(DstIpAddr)
  | where ipv4_is_private(SrcIpAddr) == False
  | extend k = 1
  | join kind=innerunique (r_dports) on k
  | where dports has tostring(DstPortNumber)
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
status: Available
triggerOperator: gt
kind: Scheduled
triggerThreshold: 0
relevantTechniques:
- T1595
id: 482c24b9-a700-4b2a-85d3-1c42110ba78c
queryPeriod: 14d
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
severity: Medium
name: OCI - Multiple rejects on rare ports
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleRejects.yaml
requiredDataConnectors:
- dataTypes:
  - OCILogs
  connectorId: OracleCloudInfrastructureLogsConnector

ARM