Identities Bad Reputation ASN Activities
Query
let CIDRASN = (externaldata (CIDR:string, CIDRASN:int, CIDRASNName:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-asn.csv.zip']
with (ignoreFirstRecord=true));
let Malicious_ASN= (externaldata (asn:string)['https://www.spamhaus.org/drop/asndrop.json']with(format="multijson"));
IdentityLogonEvents
| evaluate ipv4_lookup(CIDRASN, IPAddress , CIDR, return_unmatched=true)
| extend GeoIPData = geo_info_from_ip_address(IPAddress)
| where isnotempty( CIDR)
| extend asn_info = tostring(CIDRASN)
//| where ActionType has "LogonSuccess"
| join kind=inner (Malicious_ASN) on $left.asn_info == $right.asnAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1078 | Valid Accounts |
Author: Sergio Albea (22/08/2024)
Identities Bad Reputation ASN activities
Description: This new query generates additional information using ASN/CIDR info from 'Firewall IP Lists @ Gyp the Cat dot Com' site (which takes data provided by other services and formats them) combined with a 'Bad ASN Rate/Reputation' source from the well-known source SpamHaus. As a result, it will show if some user sign-in attempt was trigger from a SenderIP address related to the mentioned ASN's and it can be filtered to just show the 'LoginSuccess' cases:
Explanation
This query is designed to identify potentially suspicious user sign-in attempts by analyzing the IP addresses involved in the logon events. Here's a simplified breakdown of what the query does:
-
Data Sources:
- It uses two external data sources:
- A list of IP address ranges (CIDR) and their associated Autonomous System Numbers (ASN) from a site called "Firewall IP Lists @ Gyp the Cat dot Com."
- A list of ASNs with a bad reputation from SpamHaus, a well-known source for identifying malicious networks.
- It uses two external data sources:
-
Process:
- The query retrieves the CIDR and ASN information from the first data source.
- It retrieves the list of malicious ASNs from SpamHaus.
- It then looks up the ASN information for each IP address in the
IdentityLogonEventstable to see if it matches any of the CIDR ranges. - It enriches the data with geographical information based on the IP address.
- It filters out any logon events that do not have a CIDR match.
- It checks if the ASN associated with the IP address is listed as malicious by SpamHaus.
-
Output:
- The query results in a list of user sign-in attempts where the IP address is associated with a known bad ASN, indicating potentially suspicious activity.
-
Optional Filtering:
- The query includes a commented-out line that, if activated, would filter the results to only show successful logon attempts (
LogonSuccess).
- The query includes a commented-out line that, if activated, would filter the results to only show successful logon attempts (
In essence, this query helps identify potentially risky sign-in attempts by cross-referencing IP addresses with known malicious networks.
