Elastic low stable kql

Potential Port Scanning Activity from Compromised Host

This rule detects potential port scanning activity from a compromised host. Port scanning is a common reconnaissance technique used by attackers to identify open ports and services on a target system. A compromised host may exhibit port scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable services, or prepare for further exploitation. This rule identifies potential port scanning activity by monitoring network connection attempts from a single host to a large number of ports within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.

View Source

Detection Logic

from logs-endpoint.events.network-* metadata _id, _index, _version
| mv_expand event.action
| where
    host.os.type == "linux" and
    event.type == "start" and
    event.action == "connection_attempted" and
    network.direction  == "egress" and
    destination.port < 32768 and
    not (
      cidr_match(destination.ip, "127.0.0.0/8", "::1", "FE80::/10", "FF00::/8") or
      process.name in ("java", "node") or
      process.name like "python*" or
      process.executable in (
        "/opt/dbtk/bin/jsvc", "/usr/lib/dotnet/dotnet", "/usr/sbin/haproxy", "/opt/kaspersky/kesl/libexec/kesl",
        "/usr/bin/dotnet", "/usr/sap/SAPBusinessOne/EDS/bin/EDFBackend", "/usr/local/bin/longhorn-instance-manager"
      ) or
      process.executable like "/var/opt/kaspersky/kesl/*kesl" or
      process.executable like "/opt/google/chrome*" or
      process.executable like "/snap/*" or
      process.executable like "/home/*/.local/share/JetBrains/*"
    )
| keep
    @timestamp,
    _id,
    _index,
    _version,
    host.os.type,
    event.type,
    event.action,
    network.direction,
    destination.port,
    process.executable,
    process.name,
    destination.ip,
    source.ip,
    agent.id,
    host.name,
    data_stream.dataset,
    data_stream.namespace
| stats
    Esql.event_count = count(),
    Esql.destination_port_count_distinct = count_distinct(destination.port),
    Esql.agent_id_count_distinct = count_distinct(agent.id),
    Esql.host_name_values = values(host.name),
    Esql.agent_id_values = values(agent.id),
    Esql.source_ip_values = values(source.ip),
    Esql.data_stream_dataset_values = values(data_stream.dataset),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
    by process.executable, destination.ip
| where
    Esql.agent_id_count_distinct == 1 and
    Esql.destination_port_count_distinct > 100
| sort Esql.event_count asc

// Extract unique values to ECS fields for alerts exclusion
| eval agent.id = mv_min(Esql.agent_id_values),
       host.name = mv_min(Esql.host_name_values)
| keep agent.id, host.name, process.executable, destination.ip, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...