[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/11/03"

[rule]
author = ["Elastic"]
description = """
This rule detects events that may describe database traffic (MS SQL, Oracle, MySQL, and Postgresql) across the Internet.
Databases should almost never be directly exposed to the Internet, as they are frequently targeted by threat actors to
gain initial access to network resources.
"""
false_positives = [
    """
    Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed
    web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be
    excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and
    database instances are accessed directly across the Internet.
    """,
]
index = ["filebeat-*", "packetbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "SQL Traffic to the Internet"
risk_score = 47
rule_id = "139c7458-566a-410c-a5cd-f80238d6a5cd"
severity = "medium"
tags = ["Elastic", "Host", "Network", "Threat Detection", "Command and Control"]
type = "query"

query = '''
event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(1433 or 1521 or 3306 or 5432) or event.dataset:zeek.mysql) and
  source.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  ) and
  not destination.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.168.0.0/16 or
    224.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

