sync: update community detections

Author: hazcod

entries/kql/019cc769-8a6e-7799-ab73-dd15c4a45800.yaml

@@ -0,0 +1,11 @@
+id: 019cc769-8a6e-7799-ab73-dd15c4a45800
+name: Network Connections and Sign-ins from Iranian IP Addresses
+description: This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
+query: "let IranIPList = toscalar(\r\n    externaldata(ip:string)\r\n    [\r\n        h@\"https://raw.githubusercontent.com/Ramtiiin/iran-ip/main/ip-list.rsc\"\r\n    ]\r\n    with(format=\"txt\")\r\n    | summarize make_list(ip)\r\n);\r\nlet DNE_IranRanges = DeviceNetworkEvents\r\n| where isnotempty(RemoteIP)\r\n| where ipv4_is_in_any_range(RemoteIP, IranIPList)\r\n| extend SourceType = \"DeviceNetworkEvent_IranIPRange\"\r\n| project\r\n    TimeGenerated,\r\n    SourceType,\r\n    IP = RemoteIP,\r\n    RemotePort,\r\n    Protocol,\r\n    DeviceName,\r\n    InitiatingProcessFileName,\r\n    ActionType;\r\nlet Signin_IranRanges = SigninLogs\r\n| where isnotempty(IPAddress)\r\n| where ipv4_is_in_any_range(IPAddress, IranIPList)\r\n| extend SourceType = \"SigninLog_IranIPRange\"\r\n| project\r\n    TimeGenerated,\r\n    SourceType,\r\n    IP = IPAddress,\r\n    UserPrincipalName,\r\n    LocationDetails,\r\n    ClientAppUsed,\r\n    ConditionalAccessStatus,\r\n    ResultType;\r\nlet Signin_IranCountryNotInRange = SigninLogs\r\n| where isnotempty(IPAddress)\r\n| extend Country = tostring(LocationDetails.countryOrRegion)\r\n| where Country == \"IR\"\r\n| where not(ipv4_is_in_any_range(IPAddress, IranIPList))\r\n| extend SourceType = \"SigninLog_IranCountry_NotInRange\"\r\n| project\r\n    TimeGenerated,\r\n    SourceType,\r\n    IP = IPAddress,\r\n    UserPrincipalName,\r\n    Country,\r\n    ClientAppUsed,\r\n    ConditionalAccessStatus,\r\n    ResultType;\r\nDNE_IranRanges\r\n| union Signin_IranRanges\r\n| union Signin_IranCountryNotInRange\r\n| order by TimeGenerated desc\r\n"
+query_type: kql
+severity: medium
+tags:
+    - kql
+version: "1"
+references:
+    - https://raw.githubusercontent.com/Ramtiiin/iran-ip/main/ip-list.rsc

entries/kql/019cc806-9f48-747d-afec-9f5db45e07ad.yaml

@@ -0,0 +1,18 @@
+id: 019cc806-9f48-747d-afec-9f5db45e07ad
+name: 'Suspicious sign-in activities '
+description: 'Detects suspicious sign-in activities by user in a specified timeframe '
+query: "let UPN = \"userupn\";\r\nlet TimeFrame = ago(30d);\r\nSigninLogs\r\n| where TimeGenerated > TimeFrame\r\n| where UserPrincipalName =~ UPN\r\n| summarize FirstSeen = min(TimeGenerated = 0), LastObserved = max(TimeGenerated), SuccessfullCount = count(ResultType= 0 ), FailureCount = count(ResultType!=0) by UserPrincipalName, IPAddress, Location, UserAgent, ClientAppUsed, AppDisplayName"
+query_type: kql
+severity: medium
+tactics:
+    - TA0005
+    - TA0003
+    - TA0004
+    - TA0001
+techniques:
+    - T1078
+    - T1078.004
+tags:
+    - kql
+author: Mahdi Akbari
+version: "1"

library.index.yaml

@@ -42161,6 +42161,35 @@ entries:
       references:
         - https://www.derp.ca/research/fakegit-luajit-github-campaign/
       file: entries/kql/019cc4ec-d430-75ff-8869-f41c2618d04d.yaml
+    - id: 019cc769-8a6e-7799-ab73-dd15c4a45800
+      name: Network Connections and Sign-ins from Iranian IP Addresses
+      description: This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
+      query_type: kql
+      severity: medium
+      tags:
+        - kql
+      version: "1"
+      references:
+        - https://raw.githubusercontent.com/Ramtiiin/iran-ip/main/ip-list.rsc
+      file: entries/kql/019cc769-8a6e-7799-ab73-dd15c4a45800.yaml
+    - id: 019cc806-9f48-747d-afec-9f5db45e07ad
+      name: 'Suspicious sign-in activities '
+      description: 'Detects suspicious sign-in activities by user in a specified timeframe '
+      query_type: kql
+      severity: medium
+      tactics:
+        - TA0005
+        - TA0003
+        - TA0004
+        - TA0001
+      techniques:
+        - T1078
+        - T1078.004
+      tags:
+        - kql
+      author: Mahdi Akbari
+      version: "1"
+      file: entries/kql/019cc806-9f48-747d-afec-9f5db45e07ad.yaml
     - id: 01bc2aa2-98db-4217-951d-727eacf33034
       name: Exposure Management + Defender for Office 365
       description: 'KQL Query from file: Exposure Management + Defender for Office 365'