Detect SNMP (MIB Dump) in Microsoft Sentinel

let TimeWindow = 24h;
let SNMPTools = dynamic(["snmpwalk.exe", "snmpget.exe", "snmpbulkwalk.exe", "snmptable.exe", "snmpset.exe", "snmpgetnext.exe", "snmpdf.exe", "snmpnetstat.exe"]);
let WeakCommunities = dynamic(["-c public", "-c private", "-c cisco", "-c monitor", "-c manager", "-c secret", "-c admin", "community public", "community private"]);
// Detection Path 1: SNMP enumeration tools executed on Windows/Linux endpoints
let EndpointSNMPTools = DeviceProcessEvents
| where Timestamp > ago(TimeWindow)
| where FileName in~ (SNMPTools)
    or (ProcessCommandLine has "snmp"
        and (ProcessCommandLine has ".1.3.6"
             or ProcessCommandLine has_any (WeakCommunities)
             or ProcessCommandLine has "-v1"
             or ProcessCommandLine has "-v2c"
             or ProcessCommandLine has "-OXsq"))
| extend AlertType = "SNMP_Tool_Execution"
| extend UsingDefaultCommunity = ProcessCommandLine has_any (WeakCommunities)
| extend MIBWalkDetected = ProcessCommandLine has ".1.3.6"
| extend BulkWalk = FileName has_any ("snmpbulk", "snmpwalk")
| extend RiskScore = case(
    UsingDefaultCommunity and MIBWalkDetected, 95,
    UsingDefaultCommunity, 85,
    MIBWalkDetected, 75,
    70)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          AlertType, UsingDefaultCommunity, MIBWalkDetected, BulkWalk, RiskScore;
// Detection Path 2: High-volume outbound SNMP UDP/161 traffic indicating automated MIB walk
let SNMPTrafficBurst = DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where RemotePort == 161
| summarize
    SNMPRequests = count(),
    UniqueTargets = dcount(RemoteIP),
    TargetIPs = make_set(RemoteIP, 25),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
     AccountName = InitiatingProcessAccountName,
     bin(Timestamp, 10m)
| where SNMPRequests > 20 or UniqueTargets > 3
| extend AlertType = "High_Volume_SNMP_Scan"
| extend RiskScore = case(
    UniqueTargets > 20, 95,
    UniqueTargets > 10, 85,
    SNMPRequests > 100, 80,
    65)
| project Timestamp, DeviceName, AccountName,
          FileName = InitiatingProcessFileName,
          ProcessCommandLine = InitiatingProcessCommandLine,
          AlertType, SNMPRequests, UniqueTargets, TargetIPs, RiskScore;
// Detection Path 3: SNMP authentication failures on network devices (Syslog)
let SNMPAuthFailures = Syslog
| where TimeGenerated > ago(TimeWindow)
| where SyslogMessage has_any ("SNMP", "snmp")
| where SyslogMessage has_any (
    "Authentication failure", "authentication failure", "authenticationFailure",
    "Unknown community", "wrong community", "No Such Name",
    "invalid community", "Community name mismatch", "community string")
| summarize
    FailureCount = count(),
    SampleMessages = make_set(SyslogMessage, 3),
    UniqueSourceIPs = dcount(extract(@"from\s+(\d+\.\d+\.\d+\.\d+)", 1, SyslogMessage))
  by HostName, bin(TimeGenerated, 1h)
| where FailureCount >= 5
| extend AlertType = "SNMP_Auth_Failures_Network_Device"
| extend RiskScore = case(FailureCount > 50, 92, FailureCount > 20, 78, 62)
| project Timestamp = TimeGenerated, DeviceName = HostName,
          AccountName = "NetworkDevice",
          FileName = "snmpd",
          ProcessCommandLine = strcat("Failures: ", tostring(FailureCount), " UniqueSourceIPs: ", tostring(UniqueSourceIPs), " Sample: ", tostring(SampleMessages)),
          AlertType, FailureCount, UniqueSourceIPs, RiskScore;
// Combined output across all detection paths
EndpointSNMPTools
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, AlertType, RiskScore
| union (SNMPTrafficBurst
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, AlertType, RiskScore)
| union (SNMPAuthFailures
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, AlertType, RiskScore)
| sort by Timestamp desc