Identifying Devices By Vendor Based On Inbound Connections

Query

// Importing the Vendor MAC Address table 
let mac_info = externaldata(mac: string)[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/refs/heads/main/Security-Lists/mac_list_Type2.txt"] with (format="txt", ignoreFirstRecord=True);
let info =mac_info
| extend SplitValues = split(mac, ",")
| extend mac = tostring(SplitValues[0]), vendor_sn = tostring( SplitValues[1]), vendor = tostring(SplitValues[2])
| project mac,vendor;
// selecting the Source MAC Address of the remote connections
DeviceNetworkEvents 
| extend AdditionalFields = parse_json( AdditionalFields)
| extend direction =  AdditionalFields["direction"]
| where direction has "In"
| extend Source_Mac =  tostring(AdditionalFields["Source Mac"])
// formatting the First 3 Octets of the MAC Address
| extend MAC_Prefix_format = replace(":", "-", Source_Mac)
| extend MAC_Prefix = substring(MAC_Prefix_format, 0, 8)
// joining the Vendor MAC address info table
| join kind=inner (info) on $left.MAC_Prefix == $right.mac
// Getting the Country of the RemoteIPs
| extend geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| where isnotempty (geo_ip)
| summarize Different_Countries_using_Manufacter_Device= dcount(geo_ip), make_set(geo_ip),Total_devices_by_vendor=dcount(Source_Mac),Total_different_RemoteIPs=dcount(RemoteIP),make_set(RemoteIP)  by vendor```

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1046	Network Service Discovery

Author: Sergio Albea (18/02/2025)

Identifying Devices by Vendor based on Inbound Connections

This KQL Query focuses on summarizing the number of devices attempting to connect to exposed servers, categorized by vendor, by decoding their MAC addresses. This information can help you to identify unexpected devices vendors, detect virtual devices or correlate specific manufacturers with known threats:

Explanation

This KQL query is designed to analyze network activity by identifying the vendors of devices attempting to connect to exposed servers. Here's a simple breakdown of what the query does:

Import Vendor MAC Address Data: It starts by importing a list of MAC addresses and their associated vendors from an external text file.
Extract and Format MAC Addresses: The query processes the MAC addresses from incoming network connections, focusing on the first three octets, which are used to identify the device's vendor.
Filter Inbound Connections: It filters the network events to only include inbound connections, meaning those where external devices are trying to connect to the server.
Join with Vendor Information: The query matches the formatted MAC addresses with the vendor information to identify the manufacturer of each device.
Geographical Analysis: It determines the country of origin for each remote IP address attempting to connect.
Summarize Results: Finally, it summarizes the data by counting the number of different countries and devices associated with each vendor, as well as listing the remote IPs involved.

This analysis helps in identifying unexpected device vendors, detecting virtual devices, and correlating specific manufacturers with potential threats.

Details

Sergio Albea

Released: July 21, 2026

Tables

DeviceNetworkEvents

Keywords

DevicesVendorConnectionsMACAddressesServersManufacturersRemoteIPsCountries

Operators

letexternaldatawithformatignoreFirstRecordextendsplittostringprojectparse_jsonhasreplacesubstringjoinon$left==$rightgeo_info_from_ip_addresswhereisnotemptysummarizedcountmake_setby

MITRE Techniques

T1046

Actions

GitHub

KQL Search