KQL Search

This KQL query is designed to help cybersecurity defenders identify potential vulnerabilities in their network by detecting endpoints that have the SMB (Server Message Block) service exposed to the public internet. Here's a simple breakdown of the query and its context:

1. Context: The query is part of a security strategy to protect against a Russian cyber threat actor known as Seashell Blizzard (also referred to as IRIDIUM), which is linked to the GRU. This group has been active since 2013 and is known for high-profile cyber attacks targeting critical infrastructure. They exploit vulnerabilities like those in Microsoft's SMBv1 protocol.

2. Purpose: The query aims to detect any devices on the network that have accepted inbound connections on port 445 (the default port for SMB) from public IP addresses. This is a potential security risk because it indicates that the SMB service is exposed to the internet, which could be exploited by attackers like Seashell Blizzard.

3. Query Breakdown:

   • DeviceNetworkEvents: This is the data source being queried, which contains network event logs.
   • | where Timestamp > ago(30d): Filters the events to only include those from the last 30 days.
   • | where ActionType == @"InboundConnectionAccepted": Focuses on events where an inbound connection was accepted.
   • | where LocalPort == "445": Specifically looks for connections on port 445, used by SMB.
   • | where RemoteIPType == @"Public": Ensures that the connection is coming from a public IP address, indicating exposure to the internet.
   • | where not (ipv4_is_private(LocalIP)): Ensures that the local IP address is not a private IP, confirming that the device is accessible from the internet.

4. Mitre ATT&CK: The query is likely aligned with the Mitre ATT&CK framework, which is a knowledge base of adversary tactics and techniques. This helps defenders understand and mitigate threats like those posed by Seashell Blizzard.

Overall, this query helps security teams identify and mitigate the risk of SMB services being exposed to the public internet, which could be exploited by threat actors for espionage or sabotage.