Managed Edge Device Hijacked Into Adversary Operational Relay Box (ORB) Network

let LookbackWindow = 24h;
let CorrelationWindow = 30m;
let MinDistinctExternalPeerPairs = 15;
let EdgeDeviceVendors = dynamic(["Cisco", "Fortinet", "SonicWall", "Ubiquiti", "MikroTik", "Juniper Networks", "pfSense", "Netgear", "TP-Link", "Palo Alto Networks", "DrayTek", "Zyxel"]);
let AdminAuthKeywords = dynamic(["login succeeded", "authentication success", "admin login", "web ui login", "user logged in", "ssh login", "successful login"]);
let ConfigChangeKeywords = dynamic(["configuration changed", "config saved", "port forward", "nat rule", "virtual server", "user added", "user created", "new admin account", "firmware", "schedule created", "cron job added"]);
let AdminLogins = CommonSecurityLog
| where TimeGenerated > ago(LookbackWindow)
| where DeviceVendor in~ (EdgeDeviceVendors)
| where Activity has_any (AdminAuthKeywords) or Message has_any (AdminAuthKeywords)
| where isnotempty(SourceIP)
| project LoginTime = TimeGenerated, DeviceHostName = DeviceName, DeviceVendor, AdminSourceIP = SourceIP, SourceUserName, LoginActivity = Activity;
let ConfigChanges = CommonSecurityLog
| where TimeGenerated > ago(LookbackWindow)
| where DeviceVendor in~ (EdgeDeviceVendors)
| where Activity has_any (ConfigChangeKeywords) or Message has_any (ConfigChangeKeywords)
| project ChangeTime = TimeGenerated, DeviceHostName = DeviceName, DeviceVendor, ChangeActivity = Activity, ChangeMessage = Message;
let SuspiciousAdminChange = AdminLogins
| join kind=inner ConfigChanges on DeviceHostName, DeviceVendor
| where ChangeTime between (LoginTime .. LoginTime + CorrelationWindow)
| project DeviceHostName, DeviceVendor, LoginTime, AdminSourceIP, SourceUserName, LoginActivity, ChangeTime, ChangeActivity, ChangeMessage;
let RelayFanout = CommonSecurityLog
| where TimeGenerated > ago(LookbackWindow)
| where DeviceVendor in~ (EdgeDeviceVendors)
| where DeviceAction =~ "allow"
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| where ipv4_is_private(SourceIP) == false and ipv4_is_private(DestinationIP) == false
| summarize ExternalToExternalSessions = count(), DistinctExternalPeerPairs = dcount(strcat(SourceIP, "->", DestinationIP)), FanoutWindowStart = min(TimeGenerated), FanoutWindowEnd = max(TimeGenerated) by DeviceHostName = DeviceName, DeviceVendor
| where DistinctExternalPeerPairs >= MinDistinctExternalPeerPairs;
SuspiciousAdminChange
| join kind=inner RelayFanout on DeviceHostName, DeviceVendor
| where FanoutWindowStart >= LoginTime
| project DeviceHostName, DeviceVendor, LoginTime, AdminSourceIP, SourceUserName, LoginActivity, ChangeTime, ChangeActivity, ChangeMessage, ExternalToExternalSessions, DistinctExternalPeerPairs, FanoutWindowStart, FanoutWindowEnd
| sort by DistinctExternalPeerPairs desc

index=network (sourcetype=cisco:asa OR sourcetype=fortinet_utm OR sourcetype=sonicwall OR sourcetype=juniper OR sourcetype=mikrotik OR sourcetype=ubnt OR sourcetype=paloalto:panos)
(Activity="*login*" OR Activity="*authentication success*" OR message="*login*" OR message="*authentication success*")
| eval DeviceHostName=coalesce(host, device_name)
| eval LoginTime=_time
| table LoginTime, DeviceHostName, src_ip, user, Activity
| join type=inner DeviceHostName
    [ search index=network (sourcetype=cisco:asa OR sourcetype=fortinet_utm OR sourcetype=sonicwall OR sourcetype=juniper OR sourcetype=mikrotik OR sourcetype=ubnt OR sourcetype=paloalto:panos)
        (Activity="*config*" OR Activity="*port forward*" OR Activity="*nat rule*" OR Activity="*user added*" OR Activity="*firmware*")
      | eval DeviceHostName=coalesce(host, device_name)
      | eval ChangeTime=_time
      | rename Activity as ChangeActivity
      | table ChangeTime, DeviceHostName, ChangeActivity
    ]
| where (ChangeTime - LoginTime) >= 0 AND (ChangeTime - LoginTime) <= 1800
| join type=inner DeviceHostName
    [ search index=network (sourcetype=cisco:asa OR sourcetype=fortinet_utm OR sourcetype=sonicwall OR sourcetype=juniper OR sourcetype=mikrotik OR sourcetype=ubnt OR sourcetype=paloalto:panos) action=allowed
      | eval DeviceHostName=coalesce(host, device_name)
      | where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip)
      | where NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("172.16.0.0/12", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip)
      | eval PeerPair=src_ip."->".dest_ip
      | stats count as ExternalToExternalSessions, dc(PeerPair) as DistinctExternalPeerPairs by DeviceHostName
      | where DistinctExternalPeerPairs >= 15
    ]
| table LoginTime, DeviceHostName, src_ip, user, Activity, ChangeTime, ChangeActivity, ExternalToExternalSessions, DistinctExternalPeerPairs
| sort - DistinctExternalPeerPairs

sequence by host.name with maxspan=30m
  [any where event.category == "authentication" and event.outcome == "success"]
  [any where event.category == "configuration" and event.action : ("config-change", "port-forward-add", "nat-rule-add", "user-add", "firmware-update")]

SELECT
    devicehostname AS DeviceHostName,
    sourceip AS SourceIP,
    destinationip AS DestinationIP,
    COUNT(*) AS ExternalToExternalSessions,
    UNIQUECOUNT(destinationip) AS DistinctExternalPeers
FROM events
WHERE
    QIDNAME(qid) ILIKE '%allow%'
    AND devicetype IN ('Cisco ASA', 'Fortinet FortiGate', 'SonicWall', 'Juniper SRX', 'MikroTik RouterOS', 'Ubiquiti EdgeOS')
    AND NOT INCIDR('10.0.0.0/8', sourceip)
    AND NOT INCIDR('172.16.0.0/12', sourceip)
    AND NOT INCIDR('192.168.0.0/16', sourceip)
    AND NOT INCIDR('10.0.0.0/8', destinationip)
    AND NOT INCIDR('172.16.0.0/12', destinationip)
    AND NOT INCIDR('192.168.0.0/16', destinationip)
    AND starttime > (NOW() - 86400000)
GROUP BY devicehostname
HAVING UNIQUECOUNT(destinationip) >= 15
ORDER BY DistinctExternalPeers DESC

_sourceCategory=network/edge/*
| parse "src=*," as src_ip nodrop
| parse "dst=*," as dst_ip nodrop
| parse "act=*," as fw_action nodrop
| where fw_action = "allow" OR fw_action = "accept"
| where !isPrivateIP(src_ip) AND !isPrivateIP(dst_ip)
| count as ExternalToExternalSessions, count_distinct(dst_ip) as DistinctExternalPeers by _sourceHost
| where DistinctExternalPeers >= 15
| sort by DistinctExternalPeers desc

rule edge_device_orb_relay_fanout {
  meta:
    author = "Detection Engineering"
    description = "Detects an edge network device carrying a high fan-out of external-to-external sessions, consistent with the device having been hijacked into an adversary ORB relay network."
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1584.008"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.security_result.action = "ALLOW"
    not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
    not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
    $device = $e.observer.hostname

  match:
    $device over 1h

  outcome:
    $session_count = count($e.metadata.id)
    $distinct_peers = count_distinct($e.target.ip)

  condition:
    $e and $distinct_peers >= 15
}

#vendor=EdgeFirewall action=allow
| !cidr(src_ip, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
| !cidr(dst_ip, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
| groupBy(
    [device_hostname],
    function=[
      count(as=ExternalToExternalSessions),
      count(field=dst_ip, distinct=true, as=DistinctExternalPeers)
    ]
  )
| test(DistinctExternalPeers >= 15)
| sort(field=DistinctExternalPeers, order=desc)