LM Internal Threat Hunting Over Routers Devices
Query
//Author Sergio Albea 30-10-2025
DeviceInfo
| where DeviceSubtype has "Router"
| join kind=inner (DeviceNetworkInfo | where isnotempty(IPAddresses)) on $left.DeviceName == $right.DeviceName
| extend d = todynamic(IPAddresses) // works for string or dynamic
| extend IP = tostring(iif(array_length(d) > 0, d[0].IPAddress, ""))
| join kind=inner (DeviceNetworkEvents | where isnotempty(RemoteIP) and isnotempty(RemoteUrl)) on $left.IP == $right.RemoteIP
| where RemoteUrl contains "IP" and isnotempty(Vendor)
// If there are devices identified as valid to connect/manage your routers, you can exclude them using the next condition
// where DeviceName2 !in ("Device1","Device2")
| extend Access_Type = case(RemoteUrl startswith "http", "🌎 Web","⚙️ Application")
| extend Connection_Result = case(ActionType has "ConnectionSuccess", "✅ ConnectionSuccess","❌ ConnectionFailed")
| summarize make_set(OSPlatform),make_set(InitiatingProcessFileName), Total_connections=count() by Vendor,Connection_From=DeviceName2,LocalIP,Access_Type,Connection_To=RemoteUrl, RemoteIP,DeviceSubtype=strcat("🛜 ",DeviceSubtype), Connection_Result```About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1021 | Remote Services |
Author: Sergio Albea (05/06/2026)
[LM] - Internal Threat Hunting over Routers Devices
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1018 | Remote System Discovery |
| Author | Sergio Albea (30/10/2025) |
|---|
Description: The query below correlates device inventory, IP assignment and network events to identify internal endpoints attempting to connect to routers — including whether they succeeded and via Web or Application access. Attack traffic often aligns with failed HTTP/HTTPS attempts or unknown device names.
Explanation
This query is designed to help identify potential internal threats by analyzing network activity related to router devices. Here's a simplified breakdown of what it does:
-
Data Sources: The query pulls data from three main sources:
- DeviceInfo: Information about devices, specifically focusing on those identified as routers.
- DeviceNetworkInfo: Details about IP addresses assigned to devices.
- DeviceNetworkEvents: Records of network events, including attempts to connect to remote IPs and URLs.
-
Process:
- It first filters for devices that are routers.
- It then joins this data with network information to find routers with assigned IP addresses.
- Another join is performed with network events to find instances where these routers were the target of connection attempts.
- The query specifically looks for connection attempts that include an IP in the URL and have a known vendor.
-
Connection Analysis:
- It categorizes the type of access attempt as either "Web" (HTTP/HTTPS) or "Application" based on the URL.
- It also determines whether the connection attempt was successful or failed.
-
Output:
- The results summarize the operating systems involved, the initiating process filenames, the total number of connection attempts, and details about the connection, such as the vendor, source device, local IP, access type, target URL, remote IP, and connection result.
-
Purpose:
- This analysis helps identify unusual or unauthorized attempts to connect to routers, which could indicate potential security threats. It highlights failed connection attempts and unknown devices, which are often associated with attack traffic.
Overall, the query is a tool for threat hunting within an organization's internal network, focusing on interactions with router devices.
