Ubiquiti - Connection to known malicious IP or C2

Back


Id	db60ca0b-b668-439b-b889-b63b57ef20fb
Rulename	Ubiquiti - Connection to known malicious IP or C2
Description	Detects allowed connections to IP addresses which are in TI list and are known to be malicious.
Severity	Medium
Tactics	Exfiltration CommandAndControl
Techniques	T1071 T1571 T1572
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiDestinationInTiList.yaml
Version	1.0.2
Arm template	db60ca0b-b668-439b-b889-b63b57ef20fb.json

KQL

let malicious_ips =
ThreatIntelligenceIndicator
| where isnotempty(NetworkIP)
| summarize make_list(NetworkIP);
UbiquitiAuditEvent
| where EventCategory =~ 'firewall'
| where ipv4_is_private(SrcIpAddr)
| where ipv4_is_private(DstIpAddr) == 'False'
| where DstIpAddr in (malicious_ips)
| where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 14d
query: |
  let malicious_ips =
  ThreatIntelligenceIndicator
  | where isnotempty(NetworkIP)
  | summarize make_list(NetworkIP);
  UbiquitiAuditEvent
  | where EventCategory =~ 'firewall'
  | where ipv4_is_private(SrcIpAddr)
  | where ipv4_is_private(DstIpAddr) == 'False'
  | where DstIpAddr in (malicious_ips)
  | where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'
  | extend IPCustomEntity = SrcIpAddr  
name: Ubiquiti - Connection to known malicious IP or C2
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiDestinationInTiList.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - Ubiquiti_CL
description: |
    'Detects allowed connections to IP addresses which are in TI list and are known to be malicious.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1071
- T1571
- T1572
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
- CommandAndControl
id: db60ca0b-b668-439b-b889-b63b57ef20fb

ARM