Detection rules › Kusto
Corelight - Network Service Scanning Multiple IP Addresses
'Identify scanning of services that may be available on the internal network.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 599570d4-06f8-4939-8e29-95cd003f1abd
name: Corelight - Network Service Scanning Multiple IP Addresses
description: |
'Identify scanning of services that may be available on the internal network.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_conn
- Corelight_v2_conn_red
- corelight_conn
- corelight_conn_red
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
let threshold = 25;
union corelight_conn, corelight_conn_red
| where local_resp == true
| where local_orig == true
| where conn_state in~ ('S0', 'REJ')
| where history !contains 'D'
| summarize count() by id_orig_h, id_resp_p, bin(TimeGenerated, 1m)
| where count_ > threshold
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 0: let
let threshold = 25;
Stage 1: union
union of 2 branches
Stage 2: source
corelight_conn
Stage 3: source
corelight_conn_red
Stage 4: where
where local_resp =~ true
Stage 5: where
where local_orig =~ true
Stage 6: where
where conn_state in~ ("REJ", "S0")
Stage 7: where
where not (history contains "D")
Stage 8: summarize
summarize by id_orig_h, id_resp_p
Stage 9: where
where count_ > 25
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
conn_state | in |
| field:"conn_state" kind:in |
count_ | gt |
| field:"count_" kind:gt value:"25" |
local_orig | eq |
| field:"local_orig" kind:eq value:"true" |
local_resp | eq |
| field:"local_resp" kind:eq value:"true" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
history | contains | D | excludes:history field:"history" value:"D" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
id_orig_h | summarize |
id_resp_p | summarize |