Detect Protocol Changes for Destination Ports

Back


Id	f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a
Rulename	Detect Protocol Changes for Destination Ports
Description	Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes.
Severity	Medium
Tactics	DefenseEvasion Exfiltration CommandAndControl
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1h
Query period	8d
Trigger threshold	1
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml
Version	1.0.0
Arm template	f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a.json

KQL

let LearningPeriod = 7d;
let RunTime = 1d;
let StartLearningPeriod = ago(LearningPeriod + RunTime);
let EndRunTime = ago(RunTime);
let LearningPortToProtocol = 
  NetworkAccessTraffic
  | where TimeGenerated between (StartLearningPeriod .. EndRunTime)
  | where isnotempty(DestinationPort)
  | summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;
let AlertTimePortToProtocol = 
  NetworkAccessTraffic
  | where TimeGenerated between (EndRunTime .. now())
  | where isnotempty(DestinationPort)
  | summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;
AlertTimePortToProtocol
  | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort and $left.SourceIp == $right.SourceIp and $left.DestinationFqdn == $right.DestinationFqdn
  | where isnull(LearningTimeProtocol) or LearningTimeProtocol != AlertTimeProtocol
  | project AlertTimeDstPort, AlertTimeProtocol, LearningTimeProtocol, SourceIp, DestinationFqdn
  | extend IPCustomEntity = SourceIp, FqdnCustomEntity = DestinationFqdn

YAML

query: |
  let LearningPeriod = 7d;
  let RunTime = 1d;
  let StartLearningPeriod = ago(LearningPeriod + RunTime);
  let EndRunTime = ago(RunTime);
  let LearningPortToProtocol = 
    NetworkAccessTraffic
    | where TimeGenerated between (StartLearningPeriod .. EndRunTime)
    | where isnotempty(DestinationPort)
    | summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;
  let AlertTimePortToProtocol = 
    NetworkAccessTraffic
    | where TimeGenerated between (EndRunTime .. now())
    | where isnotempty(DestinationPort)
    | summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;
  AlertTimePortToProtocol
    | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort and $left.SourceIp == $right.SourceIp and $left.DestinationFqdn == $right.DestinationFqdn
    | where isnull(LearningTimeProtocol) or LearningTimeProtocol != AlertTimeProtocol
    | project AlertTimeDstPort, AlertTimeProtocol, LearningTimeProtocol, SourceIp, DestinationFqdn
    | extend IPCustomEntity = SourceIp, FqdnCustomEntity = DestinationFqdn  
relevantTechniques: []
name: Detect Protocol Changes for Destination Ports
severity: Medium
triggerThreshold: 1
description: |
    Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes.
status: Available
triggerOperator: gt
id: f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a
queryPeriod: 8d
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: FqdnCustomEntity
    identifier: Url
  entityType: URL
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - EnrichedMicrosoft365AuditLogs
Configurable Parameters:
- Learning period - the time range to establish the baseline. Default is set to 7 days.
- Run time - the time range for current analysis. Default is set to 1 day.
kind: Scheduled
tactics:
- DefenseEvasion
- Exfiltration
- CommandAndControl
queryFrequency: 1h
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a')]",
      "properties": {
        "alertRuleTemplateName": "f6a8d6a5-3e9f-47c8-a8d5-1b2b9d3b7d6a",
        "Configurable Parameters": [
          "Learning period - the time range to establish the baseline. Default is set to 7 days.",
          "Run time - the time range for current analysis. Default is set to 1 day."
        ],
        "customDetails": null,
        "description": "Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes.\n",
        "displayName": "Detect Protocol Changes for Destination Ports",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "FqdnCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml",
        "query": "let LearningPeriod = 7d;\nlet RunTime = 1d;\nlet StartLearningPeriod = ago(LearningPeriod + RunTime);\nlet EndRunTime = ago(RunTime);\nlet LearningPortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (StartLearningPeriod .. EndRunTime)\n  | where isnotempty(DestinationPort)\n  | summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nlet AlertTimePortToProtocol = \n  NetworkAccessTraffic\n  | where TimeGenerated between (EndRunTime .. now())\n  | where isnotempty(DestinationPort)\n  | summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = TransportProtocol, SourceIp, DestinationFqdn;\nAlertTimePortToProtocol\n  | join kind=leftouter (LearningPortToProtocol) on $left.AlertTimeDstPort == $right.LearningTimeDstPort and $left.SourceIp == $right.SourceIp and $left.DestinationFqdn == $right.DestinationFqdn\n  | where isnull(LearningTimeProtocol) or LearningTimeProtocol != AlertTimeProtocol\n  | project AlertTimeDstPort, AlertTimeProtocol, LearningTimeProtocol, SourceIp, DestinationFqdn\n  | extend IPCustomEntity = SourceIp, FqdnCustomEntity = DestinationFqdn\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P8D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "Exfiltration"
        ],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 1
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}