Extracting Bits Of TCP Flags
Query
let binnary_codes = externaldata(Integer: string, binary: string)[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/refs/heads/main/Security-Lists/binary_list.csv"] with (format="csv", ignoreFirstRecord=True);
DeviceNetworkEvents
| extend tags = parse_json( AdditionalFields)
| extend direction = tags["direction"]
| where direction has "In"
| extend Geo_IP = tostring(geo_info_from_ip_address(RemoteIP).country)
| where isnotempty(Geo_IP)
| extend TCPFlags = tostring(tags["Tcp Flags"])
| join kind=leftouter ( binnary_codes) on $left.TCPFlags == $right.Integer
| extend num0 = strcat(substring(binary, 0,1)),num1 = strcat(substring(binary, 1,1)),num2 = strcat(substring(binary, 2,1)),num3 = strcat(substring(binary, 3,1)),num4 = strcat(substring(binary, 4,1)),num5 = strcat(substring(binary, 5,1)),num6 = strcat(substring(binary, 6,1)),num7 = strcat(substring(binary, 7,1))
| summarize make_set(binary),FIN= countif(num7 == 1),SYN= countif(num6 == 1),RST = countif(num5 == 1),PSH = countif(num4 == 1),ACK = countif(num3 == 1),URG = countif(num2 == 1),ECE = countif(num1 == 1),CWR = countif(num0 == 1), count() by RemoteIP, Geo_IPAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1046 | Network Service Discovery |
Author: Sergio Albea (03/02/2025)
Extracting bits of TCP Flags
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated.
Explanation
This KQL query is designed to analyze network traffic by examining TCP flags in incoming connections. Here's a simple breakdown of what the query does:
-
Data Source: It uses a CSV file containing binary representations of TCP flag values, which is fetched from an external source.
-
Data Filtering: The query looks at network events where the traffic direction is inbound ("In").
-
Geo-Location: It determines the country of origin for the remote IP addresses involved in these network events.
-
TCP Flags Extraction: It extracts the TCP flags from the network event data and matches them with their binary representations from the CSV file.
-
Binary Decomposition: The binary representation of each TCP flag is broken down into individual bits.
-
Flag Counting: It counts how often each TCP flag (FIN, SYN, RST, PSH, ACK, URG, ECE, CWR) is set in the incoming traffic.
-
Summary: Finally, it summarizes the data by remote IP and country, showing the set of binary flags and the count of each flag type.
Overall, this query helps identify the state of network connections and potential threats by analyzing the patterns of TCP flags in incoming traffic.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques