Elastic low stable kql

Potential Network Scan Detected

This rule identifies a potential port scan from an internal IP address. A port scan is a method utilized by attackers to systematically scan a target system for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system. This rule defines a threshold-based approach to detect connection attempts from a single internal source to a wide range of destination ports on a single destination.

View Source

Detection Logic

from logs-network_traffic.*, packetbeat-*, logs-panw.panos*
| mv_expand event.action
| where event.action in ("network_flow", "flow_started") and destination.port is not null and source.ip is not null and destination.ip is not null
| eval Esql.time_window = DATE_TRUNC(1min, @timestamp)
| where CIDR_MATCH(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| eval sensitive_port = case(destination.port IN (21, 22, 23, 53, 88, 139, 389, 445, 3389, 5900, 5985, 5986, 9389), true, false)
| stats
    Esql.count_distinct_destination_ports = COUNT_DISTINCT(destination.port),
    Esql.count_distinct_sensitive_ports = COUNT_DISTINCT(destination.port) where sensitive_port == true,
    Esql.values_destination_ports = VALUES(destination.port),
    Esql.values_sensitive_ports = VALUES(destination.port) where sensitive_port == true
  by Esql.time_window, destination.ip, source.ip
| where (Esql.count_distinct_destination_ports >= 50 or Esql.count_distinct_sensitive_ports >= 5)
| keep source.ip, destination.ip, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...