UniFi Site Manager Devices adopted outside business hours

Back


Id	77bba2d0-92e1-408d-9e43-2d6e5e81538e
Rulename	UniFi Site Manager: Devices adopted outside business hours
Description	New devices adopted into a UniFi site outside business hours (10pm - 6am local time, or weekends). Legitimate admin work usually happens in hours; unattended adoption can be unauthorised hardware joining the network.
Tactics	Persistence
Techniques	T1098
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	HuntingQuery
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Hunting Queries/UniFiCloudOffHoursDeviceAdoption.yaml
Version	1.0.0
Arm template	77bba2d0-92e1-408d-9e43-2d6e5e81538e.json

KQL

Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(30d)
| summarize arg_max(TimeGenerated, *) by Id
| where isnotempty(AdoptionTime)
| extend AdoptedAt = todatetime(AdoptionTime),
         AdoptedHour = hourofday(todatetime(AdoptionTime)),
         AdoptedDow = dayofweek(todatetime(AdoptionTime))
| where (AdoptedHour < 6 or AdoptedHour >= 22) or AdoptedDow in (0d, 6d)
| project HostName=Name, Model=Model, ['Product line']=ProductLine, AdoptedAt, AdoptedHour, IPAddress=Ip
| order by AdoptedAt desc

YAML

description: |
    New devices adopted into a UniFi site outside business hours (10pm - 6am local time, or weekends). Legitimate admin work usually happens in hours; unattended adoption can be unauthorised hardware joining the network.
id: 77bba2d0-92e1-408d-9e43-2d6e5e81538e
version: 1.0.0
tactics:
- Persistence
name: 'UniFi Site Manager: Devices adopted outside business hours'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Hunting Queries/UniFiCloudOffHoursDeviceAdoption.yaml
kind: HuntingQuery
query: |
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(30d)
  | summarize arg_max(TimeGenerated, *) by Id
  | where isnotempty(AdoptionTime)
  | extend AdoptedAt = todatetime(AdoptionTime),
           AdoptedHour = hourofday(todatetime(AdoptionTime)),
           AdoptedDow = dayofweek(todatetime(AdoptionTime))
  | where (AdoptedHour < 6 or AdoptedHour >= 22) or AdoptedDow in (0d, 6d)
  | project HostName=Name, Model=Model, ['Product line']=ProductLine, AdoptedAt, AdoptedHour, IPAddress=Ip
  | order by AdoptedAt desc  
relevantTechniques:
- T1098
requiredDataConnectors:
- dataTypes:
  - Unifi_SiteManager_Devices_CL
  connectorId: UniFiSiteManagerConnectorDefinition
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: IPAddress
    identifier: Address
  entityType: IP

ARM