Ubiquiti - Connection to known malicious IP or C2

Back


Id	db60ca0b-b668-439b-b889-b63b57ef20fb
Rulename	Ubiquiti - Connection to known malicious IP or C2
Description	Detects allowed connections to IP addresses which are in TI list and are known to be malicious.
Severity	Medium
Tactics	Exfiltration CommandAndControl
Techniques	T1071 T1571 T1572
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiDestinationInTiList.yaml
Version	1.0.2
Arm template	db60ca0b-b668-439b-b889-b63b57ef20fb.json

KQL

let malicious_ips =
ThreatIntelligenceIndicator
| where isnotempty(NetworkIP)
| summarize make_list(NetworkIP);
UbiquitiAuditEvent
| where EventCategory =~ 'firewall'
| where ipv4_is_private(SrcIpAddr)
| where ipv4_is_private(DstIpAddr) == 'False'
| where DstIpAddr in (malicious_ips)
| where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'
| extend IPCustomEntity = SrcIpAddr

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiDestinationInTiList.yaml
query: |
  let malicious_ips =
  ThreatIntelligenceIndicator
  | where isnotempty(NetworkIP)
  | summarize make_list(NetworkIP);
  UbiquitiAuditEvent
  | where EventCategory =~ 'firewall'
  | where ipv4_is_private(SrcIpAddr)
  | where ipv4_is_private(DstIpAddr) == 'False'
  | where DstIpAddr in (malicious_ips)
  | where DvcAction =~ 'Accepted' or DvcAction =~ 'Other'
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- dataTypes:
  - Ubiquiti_CL
  connectorId: CustomLogsAma
tactics:
- Exfiltration
- CommandAndControl
name: Ubiquiti - Connection to known malicious IP or C2
relevantTechniques:
- T1071
- T1571
- T1572
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
kind: Scheduled
queryFrequency: 1h
description: |
    'Detects allowed connections to IP addresses which are in TI list and are known to be malicious.'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.2
queryPeriod: 14d
id: db60ca0b-b668-439b-b889-b63b57ef20fb

ARM