Abnormal Port to Protocol

Back


Id	826f930c-2f25-4508-8e75-a95b809a4e15
Rulename	Abnormal Port to Protocol
Description	Identifies communication for well known protocol over a non-standard port based on learning period activity. This can indicate malicious communication (C2) or exfiltration by attackers trying to communicate over known ports (22:SSH, 80:HTTP) but dont use the known protocol headers to match the port number. Configurable Parameters: - Learning period time - learning period for protocol learning in days. Default is set to 7.
Severity	Medium
Tactics	DefenseEvasion Exfiltration CommandAndControl
Required data connectors	AzureFirewall
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	1
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml
Version	1.0.0
Arm template	826f930c-2f25-4508-8e75-a95b809a4e15.json

KQL

let LearningPeriod = 7d;
let RunTime = 1d;
let StartLearningPeriod = LearningPeriod + RunTime;
let EndRunTime = RunTime - 1d;
let LearningPortToProtocol = (AzureDiagnostics
| where OperationName == "AzureFirewallApplicationRuleLog"
| parse msg_s with protocol " request from " srcip ":" srcport " to " dsturl ":" dstport "." *
| where isnotempty(dstport)
| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))
| summarize LearningTimeCount = count() by LearningTimeDstPort = dstport, LearningTimeProtocol = protocol, srcip, dsturl);
let AlertTimePortToProtocol = (AzureDiagnostics
| where OperationName == "AzureFirewallApplicationRuleLog"
| parse msg_s with protocol " request from " srcip ":" srcport " to " dsturl ":" dstport "." *
| where isnotempty(dstport)
| where TimeGenerated between (ago(RunTime) .. ago(EndRunTime))
| summarize AlertTimeCount = count() by AlertTimeDstPort = dstport, AlertTimeProtocol = protocol);
AlertTimePortToProtocol 
| join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
| where LearningTimeProtocol != AlertTimeProtocol
| extend IPCustomEntity = srcip, URLCustomEntity = dsturl

YAML

severity: Medium
triggerThreshold: 1
query: |
  let LearningPeriod = 7d;
  let RunTime = 1d;
  let StartLearningPeriod = LearningPeriod + RunTime;
  let EndRunTime = RunTime - 1d;
  let LearningPortToProtocol = (AzureDiagnostics
  | where OperationName == "AzureFirewallApplicationRuleLog"
  | parse msg_s with protocol " request from " srcip ":" srcport " to " dsturl ":" dstport "." *
  | where isnotempty(dstport)
  | where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))
  | summarize LearningTimeCount = count() by LearningTimeDstPort = dstport, LearningTimeProtocol = protocol, srcip, dsturl);
  let AlertTimePortToProtocol = (AzureDiagnostics
  | where OperationName == "AzureFirewallApplicationRuleLog"
  | parse msg_s with protocol " request from " srcip ":" srcport " to " dsturl ":" dstport "." *
  | where isnotempty(dstport)
  | where TimeGenerated between (ago(RunTime) .. ago(EndRunTime))
  | summarize AlertTimeCount = count() by AlertTimeDstPort = dstport, AlertTimeProtocol = protocol);
  AlertTimePortToProtocol 
  | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
  | where LearningTimeProtocol != AlertTimeProtocol
  | extend IPCustomEntity = srcip, URLCustomEntity = dsturl  
queryFrequency: 1h
requiredDataConnectors:
- connectorId: AzureFirewall
  dataTypes:
  - AzureDiagnostics
id: 826f930c-2f25-4508-8e75-a95b809a4e15
version: 1.0.0
name: Abnormal Port to Protocol
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml
queryPeriod: 1h
relevantTechniques: []
triggerOperator: gt
tactics:
- DefenseEvasion
- Exfiltration
- CommandAndControl
description: |
  'Identifies communication for well known protocol over a non-standard port based on learning period activity. This can indicate malicious communication (C2) or exfiltration by attackers trying to communicate over known ports (22:SSH, 80:HTTP) but dont use the known protocol headers to match the port number.

  Configurable Parameters:

  - Learning period time - learning period for protocol learning in days. Default is set to 7.'  
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: URLCustomEntity

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/826f930c-2f25-4508-8e75-a95b809a4e15')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/826f930c-2f25-4508-8e75-a95b809a4e15')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Abnormal Port to Protocol",
        "description": "'Identifies communication for well known protocol over a non-standard port based on learning period activity. This can indicate malicious communication (C2) or exfiltration by attackers trying to communicate over known ports (22:SSH, 80:HTTP) but dont use the known protocol headers to match the port number.\n\nConfigurable Parameters:\n\n- Learning period time - learning period for protocol learning in days. Default is set to 7.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let LearningPeriod = 7d;\nlet RunTime = 1d;\nlet StartLearningPeriod = LearningPeriod + RunTime;\nlet EndRunTime = RunTime - 1d;\nlet LearningPortToProtocol = (AzureDiagnostics\n| where OperationName == \"AzureFirewallApplicationRuleLog\"\n| parse msg_s with protocol \" request from \" srcip \":\" srcport \" to \" dsturl \":\" dstport \".\" *\n| where isnotempty(dstport)\n| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))\n| summarize LearningTimeCount = count() by LearningTimeDstPort = dstport, LearningTimeProtocol = protocol, srcip, dsturl);\nlet AlertTimePortToProtocol = (AzureDiagnostics\n| where OperationName == \"AzureFirewallApplicationRuleLog\"\n| parse msg_s with protocol \" request from \" srcip \":\" srcport \" to \" dsturl \":\" dstport \".\" *\n| where isnotempty(dstport)\n| where TimeGenerated between (ago(RunTime) .. ago(EndRunTime))\n| summarize AlertTimeCount = count() by AlertTimeDstPort = dstport, AlertTimeProtocol = protocol);\nAlertTimePortToProtocol \n| join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort\n| where LearningTimeProtocol != AlertTimeProtocol\n| extend IPCustomEntity = srcip, URLCustomEntity = dsturl\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 1,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Exfiltration",
          "CommandAndControl"
        ],
        "techniques": [],
        "alertRuleTemplateName": "826f930c-2f25-4508-8e75-a95b809a4e15",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          },
          {
            "fieldMappings": [
              {
                "columnName": "URLCustomEntity",
                "identifier": "Url"
              }
            ],
            "entityType": "URL"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml",
        "templateVersion": "1.0.0",
        "status": "Available"
      }
    }
  ]
}