ASN Generating High Number Of Connection Requests Based On Average
Query
let CIDRASN = (externaldata (CIDR:string, CIDRASN:int, CIDRASNName:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-asn.csv.zip'] with (ignoreFirstRecord=true));
let daily =
DeviceNetworkEvents
| where isnotempty(RemoteIP) and RemoteIPType !has "Private"
| where Timestamp >= ago(7d)
| evaluate ipv4_lookup(CIDRASN, RemoteIP, CIDR, return_unmatched=true)
| where isnotempty (CIDRASN)
| extend Day = format_datetime(startofday(Timestamp), 'yyyy-MM-dd')
| summarize Success_Connections = countif(ActionType == "ConnectionSuccess"),
Attempts_Connections = countif(ActionType == "ConnectionAttempt" or ActionType =="ConnectionFailed"),
Inspected_Connections = countif( ActionType endswith "inspected"),
Requested_Connections = countif(ActionType == "ConnectionRequest"),
make_set(CIDR),make_set(RemoteIP),Connections_x_day = count() by CIDRASN,CIDRASNName, Day;
let summary =
daily | summarize TotalConnections = sum(Connections_x_day),Distinct__Days = count(),AvgConnectionsPerDay = avg(Connections_x_day)by CIDRASN;
daily
| join kind=inner (summary) on CIDRASN
| extend Multiply_avg = AvgConnectionsPerDay * 4
| where Multiply_avg < Connections_x_day or (Distinct__Days == 1 and Attempts_Connections > 1000)
| project CIDRASNName,CIDRASN,set_CIDR,set_RemoteIP, Day,Distinct__Days ,Connections_x_day, AvgConnectionsPerDay, TotalConnections, Success_Connections, Attempts_Connections, Inspected_Connections,Requested_Connections
| order by Attempts_ConnectionsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1071.001 | Application Layer Protocol: Web Protocols |
Author: Sergio Albea (14/05/2025)
ASN generating high number of connection requests based on average
Description: Identify An ASN that typically handles an average of X connection requests per day over a consistent 7-day period suddenly triples—or more—the number of requests. (You can adjust this line to define the exact multiplication threshold). In addition, identify if during the last week, a new ASN has triggered more than 1K connection attempt during a day.
Explanation
This KQL query is designed to identify unusual network activity related to Autonomous System Numbers (ASNs), which are entities responsible for managing IP address blocks on the internet. Here's a simplified breakdown of what the query does:
-
Data Source: It uses an external data source to map IP addresses to ASNs using a CSV file containing CIDR (IP range) and ASN information.
-
Data Filtering: It filters network events from the last 7 days, focusing on events with non-private remote IP addresses.
-
Data Aggregation: For each ASN, it calculates daily statistics, including:
- Successful connections
- Connection attempts (including failed ones)
- Inspected connections
- Connection requests
- Total connections per day
-
Summary Calculation: It summarizes the data to calculate the total connections, the number of distinct days with activity, and the average connections per day for each ASN.
-
Anomaly Detection:
- It identifies ASNs where the daily connections are at least four times the average daily connections over the past week.
- It also flags any new ASN that has more than 1,000 connection attempts in a single day.
-
Output: The query outputs details of the ASNs that meet these criteria, including the ASN name, the number of connections, and other relevant statistics, sorted by the number of connection attempts.
In essence, this query helps detect potential network anomalies or suspicious activities by monitoring significant increases in connection requests associated with specific ASNs.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques