First Seen External MQTT Broker Connection

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["network_traffic", "panw", "suricata", "zeek"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the
 11previous 14 days. This includes protocol-decoded MQTT and direct AWS IoT Core MQTT identified from TLS ClientHello
 12metadata without decryption. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken,
 13IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.
 14"""
 15false_positives = [
 16    """
 17    New or infrequently used IoT devices, telemetry agents, application messaging services, test environments, and
 18    broker migrations can create legitimate first-seen relationships. Sensor onboarding or retention gaps can also cause
 19    existing relationships to appear new.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-network_traffic.tls-*", "logs-panw.panos*", "logs-suricata.eve-*", "logs-zeek.connection-*"]
 24interval = "5m"
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "First Seen External MQTT Broker Connection"
 28note = """## Triage and analysis
 29
 30### Investigating First Seen External MQTT Broker Connection
 31
 32MQTT uses a broker to relay messages between publishers and subscribers. This architecture is useful for legitimate IoT
 33and application messaging, but it also allows malware to receive commands and return results without connecting directly
 34to an operator. This rule surfaces the first protocol-decoded or application-identified MQTT relationship between an
 35internal source and an external destination within the 14-day new-terms history window.
 36
 37The alert does not prove malicious command and control. Suricata and Zeek require plaintext MQTT or traffic decrypted
 38before inspection. PAN-OS coverage depends on App-ID identifying the traffic as `mqtt-base`. The Network Packet Capture
 39path recognizes direct AWS IoT Core MQTT inside TLS without decryption by using the client-offered ALPN
 40`x-amzn-mqtt-ca` on TCP/443 or a default account-specific AWS IoT ATS SNI on TCP/8883. It does not expose MQTT client
 41IDs, topics, commands, results, or file content.
 42
 43### Possible investigation steps
 44
 45- Identify the asset, owner, operating system, and expected role of `source.ip`. MQTT from servers, workstations, routers,
 46  firewalls, build systems, and other assets that are not approved MQTT clients warrants additional scrutiny.
 47- Determine whether `destination.ip` belongs to an approved private or public MQTT broker. Review destination reputation,
 48  ASN, geolocation, passive DNS, and other internal clients communicating with it.
 49- For Network Packet Capture TLS events, preserve `tls.client.server_name` exactly. On TCP/443, verify that
 50  `tls.detailed.client_hello.extensions.application_layer_protocol_negotiation` contains `x-amzn-mqtt-ca`. On TCP/8883,
 51  confirm that the SNI matches `<account-specific-prefix>-ats.iot.<region>.amazonaws.com`. Determine whether the source
 52  asset and complete endpoint are approved for AWS IoT use.
 53- For Suricata events, inspect `suricata.eve.mqtt` for CONNECT client IDs, credentials, subscribed topics, published
 54  topics, payloads, keepalive values, and broker response codes. Review equivalent protocol details in the originating
 55  network sensor when available.
 56- Look for GUID- or UUID-scoped topics and BambooToken-associated suffixes such as `/Plugin`, `/removePlugin`,
 57  `/unPlugin`, and `/LUA`. A `Global` publication containing `online` or `offline` status and a `gid` increases confidence.
 58- Review the connection duration, reconnect cadence, bytes transferred, and additional ports contacted on the
 59  destination. BambooToken infrastructure has included TCP ports 1883, 2883, and 8883.
 60- Correlate with endpoint telemetry for unexpected MQTT-capable processes, DLL side-loading, shell execution, discovery,
 61  file transfer, or persistence. For BambooToken, investigate `OnKeySrv.exe`, `OnKeyToken_KEB.dll`, and nearby
 62  `OnKeySrv.dat` or `OnKeySvr.dat` files.
 63
 64### False positive analysis
 65
 66- Confirm newly deployed or intermittently active IoT, telemetry, messaging, and monitoring applications with the asset
 67  owner.
 68- Validate broker migrations, AWS IoT device onboarding, disaster-recovery tests, development environments, and
 69  vendor-managed services.
 70- Scope exceptions to an approved source asset and broker pair where possible. Avoid excluding all MQTT traffic or an
 71  entire public broker globally.
 72
 73### Response and remediation
 74
 75- Isolate the source if the process, topic structure, payload, or destination indicates command and control.
 76- Block unauthorized broker access and preserve MQTT transactions, flow metadata, DNS history, and endpoint process
 77  evidence.
 78- Remove confirmed malware and persistence, rotate credentials available to the affected system, and search for the same
 79  client ID, topic hierarchy, destination, and artifacts across the environment.
 80- Establish an inventory of approved MQTT clients, brokers, ports, and topic prefixes, and restrict outbound MQTT where
 81  operationally feasible.
 82"""
 83references = [
 84    "https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt",
 85    "https://hackerhermanos.com/posts/aws-iot-mqtt-red-teamer/",
 86    "https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html",
 87    "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html#event-type-mqtt",
 88    "https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html",
 89    "https://www.elastic.co/docs/reference/integrations/suricata",
 90    "https://docs.zeek.org/en/current/scripts/base/protocols/mqtt/main.zeek.html",
 91    "https://www.elastic.co/docs/reference/integrations/zeek",
 92    "https://www.elastic.co/docs/reference/integrations/panw",
 93]
 94risk_score = 47
 95rule_id = "b6e05109-768e-4673-bc7b-6760912eb704"
 96setup = """## Setup
 97
 98This rule requires one or more of the following integrations:
 99
100- Network Packet Capture with TLS parsing on TCP ports 443 and 8883 and `include_detailed_fields: true`.
101- Suricata with the MQTT application-layer parser and MQTT EVE output enabled.
102- Zeek connection logs with the MQTT analyzer enabled so `network.protocol` is populated with `mqtt`.
103- PAN-OS traffic logs with App-ID enabled and MQTT identified as `mqtt-base`.
104
105Place network sensors where they observe client-to-broker traffic before source NAT so internal client addresses remain
106visible. Suricata and Zeek must observe plaintext MQTT or receive decrypted traffic. PAN-OS must identify the session with
107the MQTT App-ID; without decryption, generic MQTT over TLS may only be identified as SSL.
108
109The Network Packet Capture AWS IoT path does not require TLS decryption. It requires SNI in `tls.client.server_name` and,
110for TCP/443, client-offered ALPN in
111`tls.detailed.client_hello.extensions.application_layer_protocol_negotiation`. Encrypted ClientHello can hide SNI, and
112custom AWS IoT domains on TCP/8883 do not match the default ATS hostname pattern.
113"""
114severity = "medium"
115tags = [
116    "Domain: Network",
117    "Domain: OT/IoT",
118    "Platform: AWS",
119    "Use Case: Network Security Monitoring",
120    "Use Case: Threat Detection",
121    "Tactic: Command and Control",
122    "Data Source: PAN-OS Logs",
123    "Data Source: Network Traffic",
124    "Data Source: Network Packet Capture",
125    "Data Source: Suricata Logs",
126    "Data Source: Zeek",
127    "Service: AWS IoT",
128    "Rule Type: New Terms",
129    "Resources: Investigation Guide",
130]
131timestamp_override = "event.ingested"
132type = "new_terms"
133
134query = '''
135(
136  data_stream.dataset:suricata.eve and
137  suricata.eve.event_type:mqtt and
138  network.protocol:mqtt or
139  data_stream.dataset:zeek.connection and
140  network.protocol:mqtt or
141  data_stream.dataset:panw.panos and
142  network.application:mqtt-base or
143  data_stream.dataset:network_traffic.tls and
144  tls.established:true and
145  tls.client.server_name:* and
146  (
147    destination.port:443 and
148    tls.detailed.client_hello.extensions.application_layer_protocol_negotiation:"x-amzn-mqtt-ca" or
149    destination.port:8883 and
150    tls.client.server_name:(
151      *-ats.iot.*.amazonaws.com or
152      *-ats.iot.*.amazonaws.com. or
153      *-ats.iot.*.amazonaws.com.cn or
154      *-ats.iot.*.amazonaws.com.cn.
155    )
156  )
157) and
158  network.transport:tcp and
159  source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7") and
160  destination.ip:(
161    * and not (
162      10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or
163      192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
164      192.0.0.8/32 or 192.0.0.9/32 or 192.0.2.0/24 or 192.168.0.0/16 or 192.175.48.0/24 or
165      192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or 198.18.0.0/15 or
166      198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or
167      "FC00::/7" or "FE80::/10" or "FF00::/8"
168    )
169  ) and
170  not (
171    data_stream.dataset:panw.panos and (
172      event.action:(flow_denied or flow_dropped) or
173      network.application:(incomplete or insufficient-data or not-applicable)
174    )
175  )
176'''
177
178
179[[rule.threat]]
180framework = "MITRE ATT&CK"
181[[rule.threat.technique]]
182id = "T1071"
183name = "Application Layer Protocol"
184reference = "https://attack.mitre.org/techniques/T1071/"
185[[rule.threat.technique.subtechnique]]
186id = "T1071.005"
187name = "Publish/Subscribe Protocols"
188reference = "https://attack.mitre.org/techniques/T1071/005/"
189
190
191
192[rule.threat.tactic]
193id = "TA0011"
194name = "Command and Control"
195reference = "https://attack.mitre.org/tactics/TA0011/"
196
197[rule.investigation_fields]
198field_names = [
199    "@timestamp",
200    "source.ip",
201    "source.port",
202    "destination.ip",
203    "destination.port",
204    "destination.as.organization.name",
205    "network.protocol",
206    "network.transport",
207    "network.application",
208    "network.community_id",
209    "tls.client.server_name",
210    "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation",
211    "data_stream.dataset",
212    "observer.name",
213]
214
215[rule.new_terms]
216field = "new_terms_fields"
217value = ["source.ip", "destination.ip"]
218[[rule.new_terms.history_window_start]]
219field = "history_window_start"
220value = "now-14d"