forked from SEVENP/Sentinel-Queries
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDevice-SSHTrafficOnNonStandardPort.kql
38 lines (37 loc) · 1.25 KB
/
Device-SSHTrafficOnNonStandardPort.kql
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
//Detect SSH traffic that isn't on port 22 connecting to public IP addresses
//Microosft Sentinel query
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are SSH but not on port 22
| where NetworkSignature == "SSH" and RemotePort != 22
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
| project
TimeGenerated,
DeviceName,
NetworkSignature,
LocalIP,
LocalPort,
RemoteIP,
RemotePort,
RemoteUrl
//Advanced Hunting query
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are SSH but not on port 22
| where NetworkSignature == "SSH" and RemotePort != 22
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
| project
Timestamp,
DeviceName,
NetworkSignature,
LocalIP,
LocalPort,
RemoteIP,
RemotePort,
RemoteUrl