Network Port Sweep from External Network ASIM Network Session schema

Back


Id	cd8faa84-4464-4b4e-96dc-b22f50c27541
Rulename	Network Port Sweep from External Network (ASIM Network Session schema)
Description	This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema.
Severity	High
Tactics	Reconnaissance Discovery
Techniques	T1590 T1046
Required data connectors	AIVectraStream AWSS3 AzureFirewall AzureMonitor(VMInsights) AzureNSG CheckPoint CiscoASA CiscoAsaAma CiscoMeraki Corelight Fortinet MicrosoftSysmonForLinux MicrosoftThreatProtection PaloAltoNetworks SecurityEvents WindowsForwardedEvents WindowsSecurityEvents Zscaler
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Network%20Session%20Essentials/Analytic%20Rules/NetworkPortSweepFromExternalNetwork.yaml
Version	1.0.5
Arm template	cd8faa84-4464-4b4e-96dc-b22f50c27541.json

KQL

let lookback = 1h;
let threshold = 20;
_Im_NetworkSession(starttime=ago(lookback),endtime=now())
| where NetworkDirection == "Inbound"
| summarize make_set(DstIpAddr,100) by SrcIpAddr, DstPortNumber
| where array_length(set_DstIpAddr) > threshold

YAML

triggerThreshold: 0
queryFrequency: 1h
kind: Scheduled
description: |
  'This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize [ASIM](https://aka.ms/AboutASIM) normalization, and is applied to any source which supports the ASIM Network Session schema.'
tags:
- Schema: ASimNetworkSessions
  SchemaVersion: 0.2.4
triggerOperator: gt
relevantTechniques:
- T1590
- T1046
version: 1.0.5
id: cd8faa84-4464-4b4e-96dc-b22f50c27541
query: |
  let lookback = 1h;
  let threshold = 20;
  _Im_NetworkSession(starttime=ago(lookback),endtime=now())
  | where NetworkDirection == "Inbound"
  | summarize make_set(DstIpAddr,100) by SrcIpAddr, DstPortNumber
  | where array_length(set_DstIpAddr) > threshold
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: Network Port Sweep detected on {{DstPortNumber}}
  alertDescriptionFormat: Network Port Sweep was detection by multiple IPs
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Network%20Session%20Essentials/Analytic%20Rules/NetworkPortSweepFromExternalNetwork.yaml
requiredDataConnectors:
- dataTypes:
  - AWSVPCFlow
  connectorId: AWSS3
- dataTypes:
  - DeviceNetworkEvents
  connectorId: MicrosoftThreatProtection
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
- dataTypes:
  - WindowsEvent
  connectorId: WindowsForwardedEvents
- dataTypes:
  - CommonSecurityLog
  connectorId: Zscaler
- dataTypes:
  - Syslog
  connectorId: MicrosoftSysmonForLinux
- dataTypes:
  - CommonSecurityLog
  connectorId: PaloAltoNetworks
- dataTypes:
  - VMConnection
  connectorId: AzureMonitor(VMInsights)
- dataTypes:
  - AzureDiagnostics
  connectorId: AzureFirewall
- dataTypes:
  - AzureDiagnostics
  connectorId: AzureNSG
- dataTypes:
  - CommonSecurityLog
  connectorId: CiscoASA
- dataTypes:
  - CommonSecurityLog
  connectorId: CiscoAsaAma
- dataTypes:
  - Corelight_CL
  connectorId: Corelight
- dataTypes:
  - VectraStream
  connectorId: AIVectraStream
- dataTypes:
  - CommonSecurityLog
  connectorId: CheckPoint
- dataTypes:
  - CommonSecurityLog
  connectorId: Fortinet
- dataTypes:
  - Syslog
  - CiscoMerakiNativePoller
  connectorId: CiscoMeraki
customDetails:
  AllDstIpAddr: set_DstIpAddr
tactics:
- Reconnaissance
- Discovery
queryPeriod: 1h
severity: High
status: Available
name: Network Port Sweep from External Network (ASIM Network Session schema)

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd8faa84-4464-4b4e-96dc-b22f50c27541')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd8faa84-4464-4b4e-96dc-b22f50c27541')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Network Port Sweep was detection by multiple IPs",
          "alertDisplayNameFormat": "Network Port Sweep detected on {{DstPortNumber}}"
        },
        "alertRuleTemplateName": "cd8faa84-4464-4b4e-96dc-b22f50c27541",
        "customDetails": {
          "AllDstIpAddr": "set_DstIpAddr"
        },
        "description": "'This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize [ASIM](https://aka.ms/AboutASIM) normalization, and is applied to any source which supports the ASIM Network Session schema.'\n",
        "displayName": "Network Port Sweep from External Network (ASIM Network Session schema)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Network%20Session%20Essentials/Analytic%20Rules/NetworkPortSweepFromExternalNetwork.yaml",
        "query": "let lookback = 1h;\nlet threshold = 20;\n_Im_NetworkSession(starttime=ago(lookback),endtime=now())\n| where NetworkDirection == \"Inbound\"\n| summarize make_set(DstIpAddr,100) by SrcIpAddr, DstPortNumber\n| where array_length(set_DstIpAddr) > threshold\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "Reconnaissance"
        ],
        "tags": [
          {
            "Schema": "ASimNetworkSessions",
            "SchemaVersion": "0.2.4"
          }
        ],
        "techniques": [
          "T1046",
          "T1590"
        ],
        "templateVersion": "1.0.5",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}