synoti logosynoti logo
MikroTik

Detection rules for MikroTik Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 6 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
DNS Cache Poisoning AttemptResource DevelopmentT1584.002 - Acquire Infrastructure: DNS ServerC:3 / I:3 / A:2
MikroTik DNS Static Entry RedirectionCredential AccessT1584.002 - Compromise Infrastructure: DNS ServerC:3 / I:3 / A:1
MikroTik New Admin User CreationPersistenceT1136 - Create AccountC:3 / I:3 / A:2
MikroTik SOCKS Proxy Enablement DetectionCommand and ControlT1090 - ProxyC:3 / I:3 / A:2
RouterOS Multiple Authentication FailuresCredential AccessT1110.001 - Brute Force: Password GuessingC:3 / I:3 / A:2
SSH Brute Force Attack on MikroTik DeviceCredential AccessT1110.001 - Brute Force: Password GuessingC:3 / I:2 / A:2

Rule Example

Below is an example of a rule definition for DNS Cache Poisoning Attempt (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-mikrotik
name: DNS Cache Poisoning Attempt
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Resource Development
technique: "T1584.002 - Acquire Infrastructure: DNS Server"
adversary: origin
references:
  - https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS
  - https://attack.mitre.org/techniques/T1584/002/
description: |
  Detects potential DNS cache poisoning attempts where multiple DNS responses are received from different sources for the same domain in a short time window, which could indicate an attacker trying to inject malicious DNS records.

  Next Steps:
  1. Verify the legitimacy of the DNS responses by checking the source IP addresses
  2. Review DNS query logs to identify the original query that triggered these responses
  3. Check if the responding IP addresses match known legitimate DNS servers
  4. Examine the timing patterns of the responses to identify potential spoofing
  5. Verify DNS server configurations and check for unauthorized DNS server additions
  6. Monitor for subsequent DNS queries to verify if poisoned cache entries are being used
  7. Consider implementing DNS security measures like DNSSEC if not already in place
where: |
  equals("log.topics", "dns") && 
  equals("target.port", 53) && 
  exists("origin.ip") &&
  contains("log.chain", "response")
afterEvents:
  - indexPattern: v1-7-22-log-firewall-mikrotik-*
    with:
      - field: target.ip
        operator: filter_term
        value: '{{.target.ip}}'
      - field: log.topics
        operator: filter_term
        value: 'dns'
    within: now-5m
    count: 10
groupBy:
  - adversary.ip
  - target.ip

Rule Details

DNS Cache Poisoning Attempt

Identifies possible DNS cache poisoning activity, in which several DNS responses for a single domain arrive from disparate sources within a brief period, potentially signaling an attacker attempting to insert harmful DNS records.

MikroTik DNS Static Entry Redirection

Identifies when static DNS entries are created or changed on MikroTik routers, which may send traffic to servers controlled by an attacker for credential theft or man-in-the-middle attacks.

MikroTik New Admin User Creation

Identifies when new administrative users are created on MikroTik RouterOS devices. Attackers who compromise MikroTik routers often establish backdoor accounts to maintain persistent access.

MikroTik SOCKS Proxy Enablement Detection

Identifies when SOCKS proxy is enabled on MikroTik routers, a frequent sign of Meris botnet infection and other malware targeting RouterOS. Attackers turn on SOCKS proxy to route malicious traffic through compromised routers.

RouterOS Multiple Authentication Failures

Identifies several failed authentication attempts against RouterOS from one source IP, which may point to a brute force attack on the device. This rule watches for login failures across all services, including SSH, Telnet, Winbox, and the web interface.

SSH Brute Force Attack on MikroTik Device

Identifies SSH brute force activity targeting MikroTik devices. It watches for several SSH connection attempts on port 22 from one source IP within a brief period, which may signal password guessing attacks.