List the devices with open database ports
Network Open Database Ports
Query
let databaseports = dynamic([1433, 1434, 1583, 3050, 3306, 3351, 5432]);
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (databaseports)
| summarize OpenPorts = make_set(LocalPort), TotalOpenDatabasePorts = dcount(LocalPort) by DeviceName
| sort by TotalOpenDatabasePortsAbout this query
List the devices with open database ports
Query Information
Description
This query lists the devices with open database ports
The database ports defined in the query:
- 1433: MSSQL
- 1434: MSSQL
- 1583: Pervasive SQL
- 3050: Firebird & Interbase
- 3306: MySQL
- 3351: Pervasive SQL
- 5432: PostgreSQL
References
Defender XDR
Sentinel
let databaseports = dynamic([1433, 1434, 1583, 3050, 3306, 3351, 5432]);
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (databaseports)
| summarize OpenPorts = make_set(LocalPort), TotalOpenDatabasePorts = dcount(LocalPort) by DeviceName
| sort by TotalOpenDatabasePorts
Explanation
This query is designed to identify devices that have open ports commonly used by various database systems. Here's a simple breakdown of what the query does:
-
Define Database Ports: It starts by defining a list of specific port numbers that are typically used by different database systems:
- 1433 and 1434 for MSSQL
- 1583 and 3351 for Pervasive SQL
- 3050 for Firebird & Interbase
- 3306 for MySQL
- 5432 for PostgreSQL
-
Filter Events: The query looks at network events on devices, specifically those where a "ListeningConnectionCreated" action has occurred. This means the device is actively listening for incoming connections on a port.
-
Identify Open Database Ports: It filters these events to find instances where the local port matches one of the defined database ports.
-
Summarize Results: For each device, it compiles a list of the open database ports and counts how many of these ports are open.
-
Sort Devices: Finally, it sorts the devices based on the total number of open database ports, likely to prioritize those with the most open ports for further investigation.
In summary, this query helps identify and prioritize devices that might be at risk due to open database ports, which could be potential entry points for unauthorized access.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators