Netskope - Suspicious Network Context Unusual IPsGeoPorts

Back


Id	6d989fb0-933e-4ae6-88fa-10e7b51c8897
Rulename	Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports)
Description	Detects suspicious network activity based on unusual source/destination IPs, geographic anomalies, uncommon ports, and high traffic volumes.
Severity	Medium
Tactics	CommandAndControl Exfiltration Discovery
Techniques	T1071 T1048 T1046
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule9.yaml
Version	1.0.0
Arm template	6d989fb0-933e-4ae6-88fa-10e7b51c8897.json

KQL

NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| extend 
    DstPort = coalesce(XCsDstPort, XSrDstPort, CsUriPort),
    SrcIP = coalesce(XCsSrcIp, CIp),
    DstIP = coalesce(XCsDstIp, XSrDstIp, SIp)
| summarize 
    EventCount = count(),
    TotalBytes = sum(Bytes),
    UniqueDstIPs = dcount(DstIP),
    DstIPs = make_set(DstIP, 20),
    UniqueDstPorts = dcount(DstPort),
    DstPorts = make_set(DstPort, 20),
    UniqueHosts = dcount(CsHost),
    Hosts = make_set(CsHost, 20),
    Countries = make_set(XSCountry),
    SuspiciousPortHits = countif(DstPort in (20, 21, 22, 23, 25, 445, 1433, 1434, 3306, 3389, 5432, 5900, 5901)),
    HighRiskCountryHits = countif(XSCountry in ('RU', 'CN', 'KP', 'IR', 'SY'))
    by CsUsername, XCsSrcIp, XCCountry, XCLocation, bin(TimeGenerated, 1h)
| where SuspiciousPortHits > 0 or HighRiskCountryHits > 0 or UniqueDstIPs > 50 or TotalBytes > 1073741824
| extend 
    TotalMB = round(TotalBytes / 1048576.0, 2),
    RiskFactors = strcat_array(array_concat(
        iff(SuspiciousPortHits > 0, dynamic(['Suspicious Ports']), dynamic([])),
        iff(HighRiskCountryHits > 0, dynamic(['High Risk Country']), dynamic([])),
        iff(UniqueDstIPs > 50, dynamic(['Many Destinations']), dynamic([])),
        iff(TotalBytes > 1073741824, dynamic(['High Volume']), dynamic([]))
    ), ', ')
| project 
    TimeGenerated,
    User = CsUsername,
    SourceIP = XCsSrcIp,
    SourceCountry = XCCountry,
    SourceLocation = XCLocation,
    DestinationIPs = DstIPs,
    UniqueDstIPCount = UniqueDstIPs,
    DestinationPorts = DstPorts,
    TargetHosts = Hosts,
    DestinationCountries = Countries,
    SuspiciousPortAccessCount = SuspiciousPortHits,
    HighRiskCountryAccessCount = HighRiskCountryHits,
    TotalDataMB = TotalMB,
    EventCount,
    RiskFactors

YAML

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: User
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule9.yaml
query: |
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | extend 
      DstPort = coalesce(XCsDstPort, XSrDstPort, CsUriPort),
      SrcIP = coalesce(XCsSrcIp, CIp),
      DstIP = coalesce(XCsDstIp, XSrDstIp, SIp)
  | summarize 
      EventCount = count(),
      TotalBytes = sum(Bytes),
      UniqueDstIPs = dcount(DstIP),
      DstIPs = make_set(DstIP, 20),
      UniqueDstPorts = dcount(DstPort),
      DstPorts = make_set(DstPort, 20),
      UniqueHosts = dcount(CsHost),
      Hosts = make_set(CsHost, 20),
      Countries = make_set(XSCountry),
      SuspiciousPortHits = countif(DstPort in (20, 21, 22, 23, 25, 445, 1433, 1434, 3306, 3389, 5432, 5900, 5901)),
      HighRiskCountryHits = countif(XSCountry in ('RU', 'CN', 'KP', 'IR', 'SY'))
      by CsUsername, XCsSrcIp, XCCountry, XCLocation, bin(TimeGenerated, 1h)
  | where SuspiciousPortHits > 0 or HighRiskCountryHits > 0 or UniqueDstIPs > 50 or TotalBytes > 1073741824
  | extend 
      TotalMB = round(TotalBytes / 1048576.0, 2),
      RiskFactors = strcat_array(array_concat(
          iff(SuspiciousPortHits > 0, dynamic(['Suspicious Ports']), dynamic([])),
          iff(HighRiskCountryHits > 0, dynamic(['High Risk Country']), dynamic([])),
          iff(UniqueDstIPs > 50, dynamic(['Many Destinations']), dynamic([])),
          iff(TotalBytes > 1073741824, dynamic(['High Volume']), dynamic([]))
      ), ', ')
  | project 
      TimeGenerated,
      User = CsUsername,
      SourceIP = XCsSrcIp,
      SourceCountry = XCCountry,
      SourceLocation = XCLocation,
      DestinationIPs = DstIPs,
      UniqueDstIPCount = UniqueDstIPs,
      DestinationPorts = DstPorts,
      TargetHosts = Hosts,
      DestinationCountries = Countries,
      SuspiciousPortAccessCount = SuspiciousPortHits,
      HighRiskCountryAccessCount = HighRiskCountryHits,
      TotalDataMB = TotalMB,
      EventCount,
      RiskFactors
tactics:
- CommandAndControl
- Exfiltration
- Discovery
queryPeriod: 1h
relevantTechniques:
- T1071
- T1048
- T1046
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
id: 6d989fb0-933e-4ae6-88fa-10e7b51c8897
kind: Scheduled
version: 1.0.0
description: |
  Detects suspicious network activity based on unusual source/destination IPs, geographic anomalies, uncommon ports, and high traffic volumes.
status: Available
name: Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports)

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6d989fb0-933e-4ae6-88fa-10e7b51c8897')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6d989fb0-933e-4ae6-88fa-10e7b51c8897')]",
      "properties": {
        "alertRuleTemplateName": "6d989fb0-933e-4ae6-88fa-10e7b51c8897",
        "customDetails": null,
        "description": "Detects suspicious network activity based on unusual source/destination IPs, geographic anomalies, uncommon ports, and high traffic volumes.\n",
        "displayName": "Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule9.yaml",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| extend \n    DstPort = coalesce(XCsDstPort, XSrDstPort, CsUriPort),\n    SrcIP = coalesce(XCsSrcIp, CIp),\n    DstIP = coalesce(XCsDstIp, XSrDstIp, SIp)\n| summarize \n    EventCount = count(),\n    TotalBytes = sum(Bytes),\n    UniqueDstIPs = dcount(DstIP),\n    DstIPs = make_set(DstIP, 20),\n    UniqueDstPorts = dcount(DstPort),\n    DstPorts = make_set(DstPort, 20),\n    UniqueHosts = dcount(CsHost),\n    Hosts = make_set(CsHost, 20),\n    Countries = make_set(XSCountry),\n    SuspiciousPortHits = countif(DstPort in (20, 21, 22, 23, 25, 445, 1433, 1434, 3306, 3389, 5432, 5900, 5901)),\n    HighRiskCountryHits = countif(XSCountry in ('RU', 'CN', 'KP', 'IR', 'SY'))\n    by CsUsername, XCsSrcIp, XCCountry, XCLocation, bin(TimeGenerated, 1h)\n| where SuspiciousPortHits > 0 or HighRiskCountryHits > 0 or UniqueDstIPs > 50 or TotalBytes > 1073741824\n| extend \n    TotalMB = round(TotalBytes / 1048576.0, 2),\n    RiskFactors = strcat_array(array_concat(\n        iff(SuspiciousPortHits > 0, dynamic(['Suspicious Ports']), dynamic([])),\n        iff(HighRiskCountryHits > 0, dynamic(['High Risk Country']), dynamic([])),\n        iff(UniqueDstIPs > 50, dynamic(['Many Destinations']), dynamic([])),\n        iff(TotalBytes > 1073741824, dynamic(['High Volume']), dynamic([]))\n    ), ', ')\n| project \n    TimeGenerated,\n    User = CsUsername,\n    SourceIP = XCsSrcIp,\n    SourceCountry = XCCountry,\n    SourceLocation = XCLocation,\n    DestinationIPs = DstIPs,\n    UniqueDstIPCount = UniqueDstIPs,\n    DestinationPorts = DstPorts,\n    TargetHosts = Hosts,\n    DestinationCountries = Countries,\n    SuspiciousPortAccessCount = SuspiciousPortHits,\n    HighRiskCountryAccessCount = HighRiskCountryHits,\n    TotalDataMB = TotalMB,\n    EventCount,\n    RiskFactors\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Discovery",
          "Exfiltration"
        ],
        "techniques": [
          "T1046",
          "T1048",
          "T1071"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}