Identify Hot Spot Connections Shared Via I Phone
Query
DeviceNetworkInfo
| where DefaultGateways has "172.20.10.1"
| extend Network_Name = tostring(parse_json(ConnectedNetworks)[0]["Name"])
| where isnotempty(Network_Name)
| extend IP_info = (todynamic(parse_json(IPAddresses)))
| mv-expand IP_info
| extend Ip_Received = tostring(parse_json(IP_info).IPAddress)
| extend IP_Type = tostring(parse_json(IP_info).AddressType)
| extend geo_ip = tostring(geo_info_from_ip_address(Ip_Received).country)
| where (Network_Name contains "Free" or Network_Name contains "Open" or Network_Name contains "Airport" or Network_Name contains "hotel")
| summarize by Network_Name, DefaultGateways,Ip_Received, IP_Type, geo_ip, DnsAddresses,DeviceName, NetworkAdapterName, NetworkAdapterStatus, NetworkAdapterType, NetworkAdapterVendorAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1557 | Adversary-in-the-Middle |
Author: Sergio Albea (26/03/2025)
Identify HotSpot connections shared via IPhone
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks. This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
Explanation
This KQL (Kusto Query Language) query is designed to identify potentially suspicious network connections shared by iPhones. Here's a simple breakdown of what the query does:
-
Purpose: The query aims to detect network connections shared by iPhones that might be involved in an "Evil Twin Attack." This is a type of cyber attack where a malicious actor sets up a fake Wi-Fi network to intercept data from unsuspecting users.
-
Key Indicator: It looks for a specific default gateway IP address, "172.20.10.1," which is commonly assigned when an iPhone shares its internet connection.
-
Network Name Filtering: The query checks if the network name contains certain keywords like "Free," "Open," "Airport," or "Hotel." These keywords are often used in public Wi-Fi networks and could indicate a potential Evil Twin Attack.
-
Data Extraction: It extracts various details about the network connection, such as:
- The name of the network.
- The IP address received.
- The type of IP address.
- The geographical location of the IP address.
- DNS addresses, device name, and network adapter details.
-
Output: The query summarizes the information by listing the network name, default gateway, IP address, IP type, geographical location, and other network adapter details. This helps in identifying and analyzing potentially malicious network activities.
In essence, this query helps security analysts detect and investigate suspicious network activities that could be indicative of a Man-in-the-Middle attack facilitated by an iPhone sharing its connection.
