List the devices with open remote service ports
Network Open Remote Service Ports
Query
let RemoteServices = dynamic([22, 139, 445, 3389, 5900, 5985, 5986]);
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (RemoteServices)
| summarize OpenPorts = make_set(LocalPort), TotalOpenRemoteServicesPorts = dcount(LocalPort) by DeviceName
| sort by TotalOpenRemoteServicesPortsAbout this query
List the devices with open remote service ports
Query Information
Description
This query lists the devices with open remote service ports
The database ports defined in the query:
- 22: SSH
- 139: SMB
- 445: SMB
- 3389: RDP
- 5900: VNC
- 5985: WinRM v2
- 5986: WinRM
Defender XDR
Sentinel
let RemoteServices = dynamic([22, 139, 445, 3389, 5900, 5985, 5986]);
DeviceNetworkEvents
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (RemoteServices)
| summarize OpenPorts = make_set(LocalPort), TotalOpenRemoteServicesPorts = dcount(LocalPort) by DeviceName
| sort by TotalOpenRemoteServicesPorts
Explanation
This query is designed to identify devices that have open ports commonly used for remote services. It focuses on specific ports associated with services like SSH, SMB, RDP, VNC, and WinRM. Here's a simple breakdown of what the query does:
-
Define Remote Service Ports: It specifies a list of ports that are typically used for remote services:
- Port 22 for SSH
- Ports 139 and 445 for SMB
- Port 3389 for RDP
- Port 5900 for VNC
- Ports 5985 and 5986 for WinRM
-
Filter Events: The query looks at network events where a device is listening for connections on these ports. This is indicated by the action type "ListeningConnectionCreated".
-
Identify Open Ports: For each device, it collects the list of open ports from the specified remote services and counts how many of these ports are open.
-
Summarize Results: It summarizes the data by device name, showing which ports are open and the total number of open remote service ports for each device.
-
Sort Devices: Finally, it sorts the devices based on the total number of open remote service ports, likely to prioritize those with more open ports for further investigation.
This query is useful for security monitoring, helping to identify devices that might be exposed to remote access vulnerabilities.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators