co- relation rule for detecting one host scanning multiple ports

Shashanksinha — Thu, 13 Apr 2023 08:43:08 GMT

Hello,

Can you please help with co- relation rule for detecting one host scanning multiple ports

Regards,

Shashank

Re: co- relation rule for detecting one host scanning multiple ports

anlynch — Fri, 14 Apr 2023 00:31:12 GMT

Hi,

Thank you for reaching LIVEcommunity.

I'm doing some research to look into this and will get back to you as soon as I can.

Re: co- relation rule for detecting one host scanning multiple ports

KanwarSingh01 — Fri, 14 Apr 2023 05:35:21 GMT

Hi,

You can probably use this, please see below:

Correlation Alert Rule Query:

config case_sensitive = false | preset = network_story | filter action_remote_port < 1025 //You can increase this number according to your needs but port range till 1025 will be good enough. | fields agent_hostname as Hostname, action_local_ip as SRC_IP, action_remote_ip as DST_IP, action_remote_port as DST_Port | comp count_distinct(DST_Port) as Counter by Hostname, SRC_IP, DST_IP | filter Counter > 25 //Adjust the counter value according to your needs.

For alert drill down, please use below:

config case_sensitive = false | dataset = xdr_data | filter action_local_ip = $SRC_IP and action_remote_ip = $DST_IP | fields agent_hostname as Hostname, action_local_ip, action_remote_ip, action_remote_port, actor_process_image_name, actor_process_command_line, actor_effective_username, actor_process_image_path

Please let us know the outcome.

topic Re: co- relation rule for detecting one host scanning multiple ports in Cortex XDR Discussions

co- relation rule for detecting one host scanning multiple ports

Re: co- relation rule for detecting one host scanning multiple ports

Re: co- relation rule for detecting one host scanning multiple ports