Suspicious External Network Connection To Malicious ASN With Rare File Execution

Query

// thx to my Buddy Sergio Albea for a big part of this Query
let CIDRASN = externaldata (CIDR:string, CIDRASN:int, CIDRASNName:string) 
    ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-asn.csv.zip'] 
    with (ignoreFirstRecord=true);
let MaliciousASNSet = toscalar(
    externaldata (asn:string) ['https://www.spamhaus.org/drop/asndrop.json'] with (format="multijson")
    | extend asn_int = toint(asn)
    | summarize make_set(asn_int)
);
let SuspiciousIPs =
    DeviceNetworkEvents
    | where TimeGenerated between (ago(8d) .. ago(1d))
    | project RemoteIP
    | summarize ConnCount = count() by RemoteIP
    | where ConnCount < 25
    | evaluate ipv4_lookup(CIDRASN, RemoteIP, CIDR)
    | where CIDRASN in (MaliciousASNSet)
    | distinct RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(1d)
| where RemoteIP in (SuspiciousIPs)
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted")
| where isnotempty(InitiatingProcessSHA256)
| invoke FileProfile(InitiatingProcessSHA256)
| where GlobalPrevalence < 2500 and GlobalFirstSeen > ago(14d)

About this query

Suspicious External Network Connection to Malicious ASN with Rare File Execution

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1078	Valid Accounts	https://attack.mitre.org/techniques/T1078
T1021	Remote Services	https://attack.mitre.org/techniques/T1021

Description

This rule identifies network connections to IP addresses belonging to known malicious Autonomous System Numbers (ASN). It filters for low-frequency connections from these malicious networks and then correlates them with the execution of files with low global prevalence (rarely seen in the environment) to detect potential malicious tool downloads or C2 communication.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect potentially malicious network activity by identifying suspicious external connections to known malicious networks and correlating them with the execution of rarely seen files. Here's a simplified breakdown of what the query does:

Identify Malicious Networks:
- It uses external data sources to identify IP addresses associated with known malicious Autonomous System Numbers (ASN). These are networks that have been flagged for malicious activity.
Filter Suspicious Connections:
- It looks at network events from the past week (8 days ago to 1 day ago) to find connections to these malicious networks.
- It filters out connections that occur frequently, focusing on those with less than 25 occurrences, indicating they are less common and potentially more suspicious.
Correlate with Recent File Executions:
- It then examines network events from the last day to see if there are any connections to these suspicious IPs.
- It checks if these connections are associated with the execution of files that have a low global prevalence (seen in fewer than 2500 instances worldwide) and have been first observed within the last 14 days.
Potential Threat Detection:
- By correlating rare file executions with connections to known malicious networks, the query aims to identify potential malicious tool downloads or command-and-control (C2) communications.

Overall, this query helps in detecting suspicious network activities that might indicate a security threat by focusing on rare and recent file executions linked to malicious networks.