LM Internal Threat Hunting Over Routers Devices
Query
//Author Sergio Albea 30-10-2025
DeviceInfo
| where DeviceSubtype has "Router"
| join kind=inner (DeviceNetworkInfo | where isnotempty(IPAddresses)) on $left.DeviceName == $right.DeviceName
| extend d = todynamic(IPAddresses) // works for string or dynamic
| extend IP = tostring(iif(array_length(d) > 0, d[0].IPAddress, ""))
| join kind=inner (DeviceNetworkEvents | where isnotempty(RemoteIP) and isnotempty(RemoteUrl)) on $left.IP == $right.RemoteIP
| where RemoteUrl contains "IP" and isnotempty(Vendor)
// If there are devices identified as valid to connect/manage your routers, you can exclude them using the next condition
// where DeviceName2 !in ("Device1","Device2")
| extend Access_Type = case(RemoteUrl startswith "http", "🌎 Web","⚙️ Application")
| extend Connection_Result = case(ActionType has "ConnectionSuccess", "✅ ConnectionSuccess","❌ ConnectionFailed")
| summarize make_set(OSPlatform),make_set(InitiatingProcessFileName), Total_connections=count() by Vendor,Connection_From=DeviceName2,LocalIP,Access_Type,Connection_To=RemoteUrl, RemoteIP,DeviceSubtype=strcat("🛜 ",DeviceSubtype), Connection_Result```About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1021 | Remote Services |
Author: Sergio Albea (09/11/2025)
[LM] - Internal Threat Hunting over Routers Devices
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1018 | Remote System Discovery |
| Author | Sergio Albea (30/10/2025) |
|---|
Description: The query below correlates device inventory, IP assignment and network events to identify internal endpoints attempting to connect to routers — including whether they succeeded and via Web or Application access. Attack traffic often aligns with failed HTTP/HTTPS attempts or unknown device names.
Explanation
This KQL query is designed to identify internal network devices that are attempting to connect to routers, focusing on whether these connection attempts are successful and the method of access (either via web or application). Here's a simplified breakdown:
-
Data Sources: The query pulls data from three main sources:
DeviceInfo: Information about devices, specifically looking for those categorized as routers.DeviceNetworkInfo: Details about the network configuration of devices, particularly their IP addresses.DeviceNetworkEvents: Logs of network events, focusing on those with remote IP and URL information.
-
Process:
- It filters for devices identified as routers.
- It joins this data with network information to get the IP addresses of these routers.
- It further joins with network event logs to find instances where internal devices attempt to connect to these router IPs.
- It checks if the connection attempts involve HTTP/HTTPS (web) or application access.
-
Connection Analysis:
- The query categorizes the type of access (web or application) and the result of the connection attempt (success or failure).
- It summarizes the data by counting the total number of connection attempts and grouping by various attributes like vendor, originating device, and connection type.
-
Outcome:
- The result is a summary that shows which internal devices are trying to connect to routers, how they are trying to connect, and whether these attempts are successful.
- This helps in identifying potential unauthorized access attempts or misconfigurations in the network.
Overall, the query is a tool for threat hunting within a network, focusing on router access attempts to detect suspicious activities.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators