Total SMB Sessions Created by a suspicious device

let TimeFrame = 24h; //Customizable h = hours, d = days let SuspiciousDevices = dynamic(['server1.com', 'laptop1.com']); DeviceNetworkEvents | where Timestamp > ago(TimeFrame) | where RemotePort == 445 | where ActionType == "ConnectionSuccess" | where DeviceName in~ (SuspiciousDevices) | summarize IPsAccessed = make_set(RemoteIP), TotalIPs = dcount(RemoteIP) by DeviceName

Sentinel

let TimeFrame = 24h; //Customizable h = hours, d = days let SuspiciousDevices = dynamic(['server1.com', 'laptop1.com']); DeviceNetworkEvents | where TimeGenerated > ago(TimeFrame) | where RemotePort == 445 | where ActionType == "ConnectionSuccess" | where DeviceName in~ (SuspiciousDevices) | summarize IPsAccessed = make_set(RemoteIP), TotalIPs = dcount(RemoteIP) by DeviceName

Explanation

This query is designed to track and summarize the activity of potentially suspicious devices by examining their SMB (Server Message Block) sessions. Here's a simple breakdown of what the query does:

Time Frame: The query looks at data from the past 24 hours, but this can be adjusted to cover different time periods.
Suspicious Devices: It focuses on a predefined list of devices that are considered suspicious, specifically 'server1.com' and 'laptop1.com'.
Data Source: The query examines network events related to these devices.
SMB Sessions: It filters the events to only include successful connections made to port 445, which is commonly used for SMB traffic.
Results: For each suspicious device, the query summarizes:
- The unique set of IP addresses that the device has accessed.
- The total count of these unique IP addresses.

In essence, this query helps identify and quantify the network activity of suspicious devices by focusing on their successful SMB connections within a specified time frame.

KQL Search