Identifying Devices By Vendor Country Based On Inbound Connections
Query
// Importing the Vendor MAC Address table
let mac_info = externaldata(MAC: string,Vendor:string ,Country:string)[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/refs/heads/main/Security-Lists/mac_list.csv"] with (format="csv", ignoreFirstRecord=True);
// selecting the Source MAC Address of the remote connections
DeviceNetworkEvents
| extend AdditionalFields = parse_json( AdditionalFields)
| extend direction = AdditionalFields["direction"]
| where direction has "In"
| extend Source_Mac = tostring(AdditionalFields["Source Mac"])
// formatting the First 3 Octets of the MAC Address
| extend MAC_Prefix_format = replace(":", "-", Source_Mac)
| extend MAC_Prefix = substring(MAC_Prefix_format, 0, 8)
// joining the Vendor MAC address info table
| join kind=inner (mac_info) on $left.MAC_Prefix == $right.MAC
// Getting the Country of the RemoteIPs
| extend geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| where isnotempty (geo_ip)
| distinct Source_Mac,Vendor, Device_Component_Country= Country, RemoteIP_Country = geo_ip , RemoteIP , ActionType, DeviceNameAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1590.005 | Gather Victim Network Information: IP Addresses |
Author: Sergio Albea (18/02/2025)
Identifying Devices by Vendor&Country based on Inbound Connections
This KQL Query focuses on summarizing the number of devices attempting to connect to exposed servers, categorized by vendor and it country, by decoding their MAC addresses. This information can help you to identify if an unusual combination appears (e.g., a Chinese-manufactured device but the connection originates from Russia), detect nation-state attack patterns, as certain adversaries often use infrastructure in specific regions and cases where attackers often route traffic through VPNs, proxies, or compromised hosts to obfuscate their real location.
Explanation
This KQL query is designed to analyze network traffic by identifying devices that are trying to connect to exposed servers. It does this by decoding the MAC addresses of these devices to determine their manufacturer (vendor) and the country where they are made. The query then compares this information with the country from which the connection is originating, based on the IP address.
Here's a simplified breakdown of what the query does:
-
Import MAC Address Data: It starts by importing a list of MAC addresses along with their corresponding vendor and country information from an external CSV file.
-
Filter Inbound Connections: It filters network events to focus only on inbound connections, meaning connections that are coming into the network.
-
Extract Source MAC Address: It extracts the source MAC address from these inbound connections.
-
Format and Match MAC Prefix: It formats the MAC address to match the first three octets (prefix) with the vendor information from the imported data.
-
Join Vendor Information: It joins the network event data with the vendor information based on the MAC prefix to identify the device's manufacturer and country.
-
Determine Connection Origin: It uses the IP address of the incoming connection to determine the country from which the connection is originating.
-
Identify Unusual Patterns: By comparing the device's manufacturing country with the connection's origin country, it helps identify unusual patterns, such as a device made in one country but connecting from another, which could indicate suspicious activity.
-
Output Distinct Results: Finally, it outputs a list of distinct connections, showing the source MAC address, vendor, device component country, remote IP country, remote IP, action type, and device name.
This analysis can help in detecting potential nation-state attacks or other suspicious activities where attackers might use VPNs or proxies to disguise their true location.
Details
Sergio Albea
Released: February 18, 2025
Tables
Keywords
Operators
MITRE Techniques