Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Unauthorized PLC changes Microsoft Defender for IoT

Back
Idc2fb27c7-5f67-49c4-aaf3-d82934234a69
RulenameUnauthorized PLC changes (Microsoft Defender for IoT)
DescriptionThis alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity on the network.
SeverityMedium
TacticsPersistence
TechniquesT0839
Required data connectorsIoT
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedPLCModifications.yaml
Version1.0.2
Arm templatec2fb27c7-5f67-49c4-aaf3-d82934234a69.json
Deploy To Azure
let alertList = dynamic(["Unpermitted Usage of Internal Indication (IIN)", "Modbus Address Range Violation", "Function Code Raised Unauthorized Exception", "Unauthorized Access to Siemens S7 Data Block", "Unauthorized Access to Wonderware Tag", "Unauthorized MMS Program Access", "GOOSE Message Type Settings", "Sampled Values Message Type Settings", "Foxboro I/A Unauthorized Operation", "New Activity Detected - CIP Class", "New Activity Detected - CIP Class Service", "New Activity Detected - CIP PCCC Command", "New Activity Detected - CIP Symbol", "New Activity Detected - EtherNet/IP I/O Connection", "New Activity Detected - EtherNet/IP Protocol Command", "New Activity Detected - GSM Message Code", "New Activity Detected - LonTalk Command Codes", "New Activity Detected - LonTalk Network Variable", "New Activity Detected - Ovation Data Request", "New Activity Detected - Read/Write Command (AMS Index Group)", "New Activity Detected - Read/Write Command (AMS Index Offset)", "New Activity Detected - Unauthorized DeltaV Message Type", "New Activity Detected - Unauthorized DeltaV ROC Operation", "New Activity Detected - Using AMS Protocol Command", "New Activity Detected - Using Siemens SICAM Command", "New Activity Detected - Using Suitelink Protocol command", "New Activity Detected - Using Suitelink Protocol sessions", "New Activity Detected - Using Yokogawa VNetIP Command", "Omron FINS Unauthorized Command", "Toshiba Computer Link Unauthorized Command", "Unauthorized ABB Totalflow File Operation", "Unauthorized ABB Totalflow Register Operation", "Unauthorized Access to Siemens S7 Plus Object", "Unauthorized BACNet Object Access", "Unauthorized BACNet Route", "Unauthorized Emerson ROC Operation", "Unauthorized GE SRTP File Access", "Unauthorized GE SRTP Protocol Command", "Unauthorized GE SRTP System Memory Operation", "Unauthorized Mitsubishi MELSEC Command", "Unauthorized MMS Service", "Unauthorized OPC UA Activity", "Unauthorized OPC UA Request/Response", "Unauthorized Profinet Frame Type", "Unauthorized SAIA S-Bus Command", "Unauthorized Siemens S7 Execution of Control Function", "Unauthorized Siemens S7 Execution of User Defined Function", "Unauthorized Siemens S7 Plus Block Access", "Unauthorized Siemens S7 Plus Operation", "Unauthorized SNMP Operation", "Unpermitted Modbus Schneider Electric Extension", "Unpermitted Usage of ASDU Types", "Unpermitted Usage of DNP3 Function Code", "Unpermitted Usage of Modbus Function Code", "Unauthorized Operation was detected by a User Defined Rule", "Unauthorized PLC Configuration Read", "Unauthorized PLC Programming", "Unauthorized PLC Configuration Write", "Unauthorized PLC Program Upload"]);
SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName has_any (alertList) 
  or ExtendedProperties has_any ("Illegal Beckhoff AMS Command", "Beckhoff AMS Command Failure")
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques
customDetails:
  AlertManagementUri: AlertManagementUri
  Sensor: DeviceId
  Protocol: Protocol
  VendorOriginalId: VendorOriginalId
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: (MDIoT) {{Description}}
  alertDynamicProperties:
  - value: ProductName
    alertProperty: ProductName
  - value: RemediationSteps
    alertProperty: RemediationSteps
  - value: Techniques
    alertProperty: Techniques
  - value: ProductComponentName
    alertProperty: ProductComponentName
  - value: AlertLink
    alertProperty: AlertLink
  alertTacticsColumnName: Tactics
  alertDisplayNameFormat: (MDIoT) {{AlertName}}
  alertSeverityColumnName: AlertSeverity
status: Available
triggerThreshold: 0
relevantTechniques:
- T0839
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedPLCModifications.yaml
requiredDataConnectors:
- dataTypes:
  - SecurityAlert (ASC for IoT)
  connectorId: IoT
queryPeriod: 1h
tactics:
- Persistence
severity: Medium
triggerOperator: gt
description: |
    'This alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity on the network.'
query: |
  let alertList = dynamic(["Unpermitted Usage of Internal Indication (IIN)", "Modbus Address Range Violation", "Function Code Raised Unauthorized Exception", "Unauthorized Access to Siemens S7 Data Block", "Unauthorized Access to Wonderware Tag", "Unauthorized MMS Program Access", "GOOSE Message Type Settings", "Sampled Values Message Type Settings", "Foxboro I/A Unauthorized Operation", "New Activity Detected - CIP Class", "New Activity Detected - CIP Class Service", "New Activity Detected - CIP PCCC Command", "New Activity Detected - CIP Symbol", "New Activity Detected - EtherNet/IP I/O Connection", "New Activity Detected - EtherNet/IP Protocol Command", "New Activity Detected - GSM Message Code", "New Activity Detected - LonTalk Command Codes", "New Activity Detected - LonTalk Network Variable", "New Activity Detected - Ovation Data Request", "New Activity Detected - Read/Write Command (AMS Index Group)", "New Activity Detected - Read/Write Command (AMS Index Offset)", "New Activity Detected - Unauthorized DeltaV Message Type", "New Activity Detected - Unauthorized DeltaV ROC Operation", "New Activity Detected - Using AMS Protocol Command", "New Activity Detected - Using Siemens SICAM Command", "New Activity Detected - Using Suitelink Protocol command", "New Activity Detected - Using Suitelink Protocol sessions", "New Activity Detected - Using Yokogawa VNetIP Command", "Omron FINS Unauthorized Command", "Toshiba Computer Link Unauthorized Command", "Unauthorized ABB Totalflow File Operation", "Unauthorized ABB Totalflow Register Operation", "Unauthorized Access to Siemens S7 Plus Object", "Unauthorized BACNet Object Access", "Unauthorized BACNet Route", "Unauthorized Emerson ROC Operation", "Unauthorized GE SRTP File Access", "Unauthorized GE SRTP Protocol Command", "Unauthorized GE SRTP System Memory Operation", "Unauthorized Mitsubishi MELSEC Command", "Unauthorized MMS Service", "Unauthorized OPC UA Activity", "Unauthorized OPC UA Request/Response", "Unauthorized Profinet Frame Type", "Unauthorized SAIA S-Bus Command", "Unauthorized Siemens S7 Execution of Control Function", "Unauthorized Siemens S7 Execution of User Defined Function", "Unauthorized Siemens S7 Plus Block Access", "Unauthorized Siemens S7 Plus Operation", "Unauthorized SNMP Operation", "Unpermitted Modbus Schneider Electric Extension", "Unpermitted Usage of ASDU Types", "Unpermitted Usage of DNP3 Function Code", "Unpermitted Usage of Modbus Function Code", "Unauthorized Operation was detected by a User Defined Rule", "Unauthorized PLC Configuration Read", "Unauthorized PLC Programming", "Unauthorized PLC Configuration Write", "Unauthorized PLC Program Upload"]);
  SecurityAlert
  | where ProviderName == "IoTSecurity"
  | where AlertName has_any (alertList) 
    or ExtendedProperties has_any ("Illegal Beckhoff AMS Command", "Beckhoff AMS Command Failure")
  | extend ExtendedProperties = parse_json(ExtendedProperties)
  | where tostring(ExtendedProperties.isNew) == "True"
  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
           Protocol = tostring(ExtendedProperties.Protocol), 
           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
  | project
    TimeGenerated,
    DeviceId,
    ProductName,
    ProductComponentName,
    AlertSeverity,
    AlertName,
    Description,
    Protocol,
    SourceDeviceAddress,
    DestDeviceAddress,
    RemediationSteps,
    Tactics,
    Entities,
    VendorOriginalId,
    AlertLink,
    AlertManagementUri,
    Techniques  
name: Unauthorized PLC changes (Microsoft Defender for IoT)
version: 1.0.2
kind: Scheduled
id: c2fb27c7-5f67-49c4-aaf3-d82934234a69
queryFrequency: 1h
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SourceDeviceAddress
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: DestDeviceAddress
    identifier: Address
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c2fb27c7-5f67-49c4-aaf3-d82934234a69')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c2fb27c7-5f67-49c4-aaf3-d82934234a69')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "(MDIoT) {{Description}}",
          "alertDisplayNameFormat": "(MDIoT) {{AlertName}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "ProductName"
            },
            {
              "alertProperty": "RemediationSteps",
              "value": "RemediationSteps"
            },
            {
              "alertProperty": "Techniques",
              "value": "Techniques"
            },
            {
              "alertProperty": "ProductComponentName",
              "value": "ProductComponentName"
            },
            {
              "alertProperty": "AlertLink",
              "value": "AlertLink"
            }
          ],
          "alertSeverityColumnName": "AlertSeverity",
          "alertTacticsColumnName": "Tactics"
        },
        "alertRuleTemplateName": "c2fb27c7-5f67-49c4-aaf3-d82934234a69",
        "customDetails": {
          "AlertManagementUri": "AlertManagementUri",
          "Protocol": "Protocol",
          "Sensor": "DeviceId",
          "VendorOriginalId": "VendorOriginalId"
        },
        "description": "'This alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity on the network.'\n",
        "displayName": "Unauthorized PLC changes (Microsoft Defender for IoT)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceDeviceAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestDeviceAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedPLCModifications.yaml",
        "query": "let alertList = dynamic([\"Unpermitted Usage of Internal Indication (IIN)\", \"Modbus Address Range Violation\", \"Function Code Raised Unauthorized Exception\", \"Unauthorized Access to Siemens S7 Data Block\", \"Unauthorized Access to Wonderware Tag\", \"Unauthorized MMS Program Access\", \"GOOSE Message Type Settings\", \"Sampled Values Message Type Settings\", \"Foxboro I/A Unauthorized Operation\", \"New Activity Detected - CIP Class\", \"New Activity Detected - CIP Class Service\", \"New Activity Detected - CIP PCCC Command\", \"New Activity Detected - CIP Symbol\", \"New Activity Detected - EtherNet/IP I/O Connection\", \"New Activity Detected - EtherNet/IP Protocol Command\", \"New Activity Detected - GSM Message Code\", \"New Activity Detected - LonTalk Command Codes\", \"New Activity Detected - LonTalk Network Variable\", \"New Activity Detected - Ovation Data Request\", \"New Activity Detected - Read/Write Command (AMS Index Group)\", \"New Activity Detected - Read/Write Command (AMS Index Offset)\", \"New Activity Detected - Unauthorized DeltaV Message Type\", \"New Activity Detected - Unauthorized DeltaV ROC Operation\", \"New Activity Detected - Using AMS Protocol Command\", \"New Activity Detected - Using Siemens SICAM Command\", \"New Activity Detected - Using Suitelink Protocol command\", \"New Activity Detected - Using Suitelink Protocol sessions\", \"New Activity Detected - Using Yokogawa VNetIP Command\", \"Omron FINS Unauthorized Command\", \"Toshiba Computer Link Unauthorized Command\", \"Unauthorized ABB Totalflow File Operation\", \"Unauthorized ABB Totalflow Register Operation\", \"Unauthorized Access to Siemens S7 Plus Object\", \"Unauthorized BACNet Object Access\", \"Unauthorized BACNet Route\", \"Unauthorized Emerson ROC Operation\", \"Unauthorized GE SRTP File Access\", \"Unauthorized GE SRTP Protocol Command\", \"Unauthorized GE SRTP System Memory Operation\", \"Unauthorized Mitsubishi MELSEC Command\", \"Unauthorized MMS Service\", \"Unauthorized OPC UA Activity\", \"Unauthorized OPC UA Request/Response\", \"Unauthorized Profinet Frame Type\", \"Unauthorized SAIA S-Bus Command\", \"Unauthorized Siemens S7 Execution of Control Function\", \"Unauthorized Siemens S7 Execution of User Defined Function\", \"Unauthorized Siemens S7 Plus Block Access\", \"Unauthorized Siemens S7 Plus Operation\", \"Unauthorized SNMP Operation\", \"Unpermitted Modbus Schneider Electric Extension\", \"Unpermitted Usage of ASDU Types\", \"Unpermitted Usage of DNP3 Function Code\", \"Unpermitted Usage of Modbus Function Code\", \"Unauthorized Operation was detected by a User Defined Rule\", \"Unauthorized PLC Configuration Read\", \"Unauthorized PLC Programming\", \"Unauthorized PLC Configuration Write\", \"Unauthorized PLC Program Upload\"]);\nSecurityAlert\n| where ProviderName == \"IoTSecurity\"\n| where AlertName has_any (alertList) \n  or ExtendedProperties has_any (\"Illegal Beckhoff AMS Command\", \"Beckhoff AMS Command Failure\")\n| extend ExtendedProperties = parse_json(ExtendedProperties)\n| where tostring(ExtendedProperties.isNew) == \"True\"\n| extend DeviceId = tostring(ExtendedProperties.DeviceId), \n         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), \n         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), \n         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), \n         Protocol = tostring(ExtendedProperties.Protocol), \n         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)\n| project\n  TimeGenerated,\n  DeviceId,\n  ProductName,\n  ProductComponentName,\n  AlertSeverity,\n  AlertName,\n  Description,\n  Protocol,\n  SourceDeviceAddress,\n  DestDeviceAddress,\n  RemediationSteps,\n  Tactics,\n  Entities,\n  VendorOriginalId,\n  AlertLink,\n  AlertManagementUri,\n  Techniques\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": null,
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}