Rockwell Automation Logix Controllers Insufficient Credential Protection (CVE-2021-22681)

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (44818, 2222, 2221) or ApplicationProtocol =~ "EtherNet/IP" or ApplicationProtocol =~ "CIP"
| where DeviceVendor =~ "Rockwell" or DeviceProduct has_any ("Logix", "ControlLogix", "CompactLogix", "GuardLogix", "SoftLogix", "DriveLogix")
| extend AuthAttempt = iff(Message has_any ("login", "authenticate", "credential", "password", "session"), true, false)
| where AuthAttempt == true or DestinationPort == 44818
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, ApplicationProtocol, Message, DeviceProduct, AdditionalExtensions
| order by TimeGenerated desc

index=ot_security OR index=network sourcetype IN ("cisco:asa", "pan:traffic", "stream:tcp", "rockwell:logix", "claroty", "nozomi", "dragos")
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (44818, 2222, 2221) OR proto="EtherNet/IP" OR proto="CIP"
| eval is_auth_event=if(match(lower(coalesce(message, payload, description)), "(login|auth|credential|password|session|token)"), 1, 0)
| eval is_logix=if(match(lower(coalesce(dest_host, dvc, product)), "(logix|controllogix|compactlogix|guardlogix|softlogix|drivelogix|rockwell)"), 1, 0)
| where dest_port=44818 OR (is_auth_event=1 AND is_logix=1)
| stats count AS connection_count, values(src_ip) AS source_ips, values(dest_ip) AS controller_ips, earliest(_time) AS first_seen, latest(_time) AS last_seen BY dest_port, proto, dvc
| where connection_count > 0
| eval risk_score=case(is_auth_event=1 AND is_logix=1, 90, dest_port=44818, 60, 1=1, 40)
| sort - risk_score

sequence by source.ip with maxspan=5m
  [network where destination.port == 44818 and
   (network.application == "EtherNet/IP" or network.application == "CIP" or destination.port in (44818, 2222, 2221)) and
   event.category == "network"]
  [network where destination.port == 44818 and
   event.category == "network" and
   (message like~ "*auth*" or message like~ "*credential*" or message like~ "*login*" or message like~ "*session*")]

SELECT sourceip, destinationip, destinationport, "protocolname", DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, username, "devicetype", logsourcename(logsourceid) AS log_source, UTF8(payload) AS raw_payload
FROM events
WHERE (destinationport IN (44818, 2222, 2221) OR "protocolname" ILIKE '%EtherNet%' OR "protocolname" ILIKE '%CIP%')
AND (logsourcename(logsourceid) ILIKE '%rockwell%' OR logsourcename(logsourceid) ILIKE '%logix%' OR logsourcename(logsourceid) ILIKE '%claroty%' OR logsourcename(logsourceid) ILIKE '%nozomi%' OR UTF8(payload) ILIKE '%logix%' OR UTF8(payload) ILIKE '%ControlLogix%')
AND LAST 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_index=ot_security OR _sourceCategory=network/ics OR _sourceCategory=firewall
| where dest_port in ("44818", "2222", "2221") or protocol matches /(?i)(EtherNet.IP|CIP)/
| where _raw matches /(?i)(logix|controllogix|compactlogix|guardlogix|rockwell)/
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as src_ip
| parse regex "dest[_\\s]?ip[=:\\s]+(?<dest_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as dest_ip nodrop
| count as connection_count by src_ip, dest_ip, dest_port, protocol
| where connection_count > 0
| sort by connection_count desc

rule cve_2021_22681_rockwell_logix_credential_abuse {
  meta:
    author = "df00tech"
    description = "Detects EtherNet/IP connections to Rockwell Logix controllers potentially exploiting CVE-2021-22681 insufficient credential protection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-22681"
  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.target.port = 44818
    (
      $network.target.hostname /(?i)(logix|controllogix|compactlogix|guardlogix|rockwell)/ or
      $network.target.application = "EtherNet/IP" or
      $network.target.application = "CIP"
    )
  condition:
    $network
}

NetworkConnectIP4
| filter RemotePort in (44818, 2222, 2221)
| filter
  MatchesGlob(RemoteHostname, "*logix*") or
  MatchesGlob(RemoteHostname, "*rockwell*") or
  MatchesGlob(CommandLine, "*EtherNet*") or
  MatchesGlob(CommandLine, "*CIP*") or
  MatchesGlob(CommandLine, "*logix*")
| join kind=inner (
    ProcessRollup2
    | filter ImageFileName matches /(?i)(rslinx|studio5000|factorytalk|rswho)/
    | project ProcessId, ImageFileName, CommandLine as ProcCmdLine, UserName
  ) on aid, ProcessId
| project timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, RemoteHostname, ImageFileName, ProcCmdLine
| sort timestamp desc