KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout (CVE-2023-4346)

let threshold = 5;
let timeWindow = 5m;
CommonSecurityLog
| where DeviceVendor has "KNX" or Message has "KNXnet" or DestinationPort == 3671
| where Activity has_any ("AUTH_FAIL", "Connection Authorization", "CONNECT_REQUEST", "Secure Session")
| summarize AttemptCount = count(), Ports = make_set(DestinationPort), Devices = make_set(DestinationIP) by SourceIP, bin(TimeGenerated, timeWindow)
| where AttemptCount >= threshold
| project TimeGenerated, SourceIP, AttemptCount, Devices, Ports
| order by AttemptCount desc

index=ics_network sourcetype=knx_gateway OR (dest_port=3671)
| eval auth_event=if(match(_raw, "(?i)(auth.?fail|connection.?authoriz|connect_request|secure.?session)"), 1, 0)
| where auth_event=1
| bin _time span=5m
| stats count as attempt_count, values(dest_ip) as targeted_devices, values(dest_port) as ports by src_ip, _time
| where attempt_count >= 5
| sort - attempt_count

sequence by source.ip with maxspan=5m
  [network where destination.port == 3671 and network.transport == "udp" and
   (message like "*AUTH_FAIL*" or message like "*Connection Authorization*" or message like "*CONNECT_REQUEST*")]
  [network where destination.port == 3671 and network.transport == "udp" and
   (message like "*AUTH_FAIL*" or message like "*Connection Authorization*" or message like "*CONNECT_REQUEST*")]

SELECT sourceip, destinationip, destinationport, COUNT(*) as attemptCount
FROM events
WHERE destinationport = 3671
AND (QIDNAME(qid) ILIKE '%Authentication Failure%' OR UTF8(payload) ILIKE '%Connection Authorization%' OR UTF8(payload) ILIKE '%CONNECT_REQUEST%')
GROUP BY sourceip, destinationip, destinationport
HAVING COUNT(*) >= 5
LAST 1 HOURS

_sourceCategory=ics/knx OR _sourceCategory=firewall/ot
| where destport = 3671
| parse regex "(?<event_type>AUTH_FAIL|Connection Authorization|CONNECT_REQUEST|Secure Session)"
| timeslice 5m
| count as attempt_count by srcip, _timeslice
| where attempt_count >= 5
| sort by attempt_count

rule knx_connection_authorization_bruteforce {
  meta:
    author = "df00tech"
    description = "Detects repeated KNX/IP secure connection authorization attempts indicative of CVE-2023-4346 exploitation"
    cve = "CVE-2023-4346"
    severity = "HIGH"
  events:
    $auth.metadata.event_type = "NETWORK_CONNECTION"
    $auth.target.port = 3671
    $auth.network.ip_protocol = "UDP"
    $auth.principal.ip = $src_ip
    re.regex($auth.metadata.description, `(?i)(AUTH_FAIL|Connection Authorization|CONNECT_REQUEST|Secure Session)`)
  match:
    $src_ip over 5m
  condition:
    #auth >= 5
}

#event_simple_name=NetworkConnectIP4
| RemotePort=3671
| Protocol="UDP"
| groupBy([LocalIP, RemoteIP], function=([count(as=attempt_count)]), limit=1000)
| test(attempt_count >= 5)
| sort(attempt_count, order=desc)