Full Report
Autonomous system numbers are like the address book of the internet, and not every IP address belongs to a “friendly” address. Learn more about how the Huntress Hunt & Response teams utilize ASNs.
Analysis Summary
# Best Practices: Utilizing Autonomous System Numbers (ASNs) for Threat Hunting
## Overview
Autonomous System Numbers (ASNs) serve as the "post offices" of the internet, grouping IP addresses under unified routing policies (e.g., Google, Microsoft, or a residential ISP). These practices address the limitations of IP-only analysis by using ASN enrichment to distinguish between legitimate user traffic (residential/mobile) and suspicious activity (hosting providers/VPNs/VPS) during incident response and threat hunting.
## Key Recommendations
### Immediate Actions
1. **Implement IP Enrichment:** Integrate ASN lookup tools (e.g., ipinfo.io, MaxMind) into your Security Operations Center (SOC) workflows to automatically append ASN data to all external IP addresses in logs.
2. **Profile "Normal" Connectivity:** Identify the typical ASNs used by your employees (e.g., local residential ISPs like Comcast or Rogers) to establish a baseline for legitimate remote access.
3. **Flag High-Risk ASNs:** Create alerts for logins or connections originating from hosting providers (e.g., DigitalOcean, Linode, OVH) or known malicious ASNs (e.g., LSHIY LLC) that your business does not explicitly use.
### Short-term Improvements (1-3 months)
1. **Anomaly Detection for RDP/VPN:** Configure monitoring to flag RDP or VPN authentication attempts originating from ASNs associated with data centers or foreign hosting providers rather than residential ISPs.
2. **Contextual Alerting:** Build correlation rules that look for "Impossible Travel" combined with ASN shifts (e.g., a user moving from a US residential ISP to a European hosting provider ASN within one hour).
3. **Automate ASN Verification:** Incorporate ASN checks into automated SOAR (Security Orchestration, Automation, and Response) playbooks to pre-calculate the risk score of an IP before an analyst views it.
### Long-term Strategy (3+ months)
1. **ASN-Based Geofencing/Conditional Access:** Beyond simple country blocking, implement Azure AD/Entra ID Conditional Access policies or Firewall rules that restrict access from specific high-risk ASNs known for hosting botnets or spray attacks.
2. **Historical ASN Trend Analysis:** Maintain a database of ASN telemetry to identify "slow and low" password spray attacks that rotate IP addresses but remain within the same ASN range (e.g., LSHIY LLC IPv6 ranges).
## Implementation Guidance
### For Small Organizations
- Use free browser extensions or web-based tools (ipinfo.io) to manually check the ASN of suspicious IPs found in login alerts.
- Focus on verifying the ASN of any successful administrative login to Microsoft 365 or Google Workspace.
### For Medium Organizations
- Use a SIEM (like ELK, Splunk, or Sentinel) to automatically enrich firewall and authentication logs with ASN metadata.
- Create a "Top 10 ASNs" dashboard to monitor which networks are most frequently hitting your public-facing infrastructure.
### For Large Enterprises
- Integrate ASN threat intelligence feeds directly into EDR and XDR platforms.
- Utilize ASN-based blocking at the Edge/CDN level to prevent large-scale automated attacks (like Azure CLI password spraying) before they reach the identity provider.
## Configuration Examples
While specific code varies by tool, the logic for a hunting query (e.g., in KQL for Sentinel) follows this pattern:
kusto
// Example: Identify RDP logins from Hosting Providers
SigninLogs
| extend ASN = tostring(parse_json(LocationDetails).asn)
| where ResultType == 0 // Successful login
| where ASN has_any ("DigitalOcean", "OVH", "Amazon", "LSHIY", "Linode")
| project TimeGenerated, UserPrincipalName, IPAddress, ASN, Location
## Compliance Alignment
- **NIST SP 800-61:** Enhances Incident Handling by providing additional context for identification and containment.
- **ISO/IEC 27001 (A.12.2.1):** Supports protection against malware and unauthorized access by identifying suspicious network origins.
- **CIS Controls (Control 8):** Audit Log Management—improving the value of logs through enrichment.
## Common Pitfalls to Avoid
- **Over-Reliance on Geolocation:** Do not ignore a US-based IP if the ASN is a data center; attackers frequently use US-based VPS providers to bypass country blocks.
- **Blocking Essential Services:** Be careful not to block major ASNs like Microsoft (AS8075) or Amazon (AS16509) if your business relies on their cloud services for legitimate traffic.
- **Ignoring IPv6:** Ensure your ASN enrichment tools support IPv6, as many modern spray attacks (like those from LSHIY) leverage IPv6 ranges.
## Resources
- **IP Info:** `https[:]//ipinfo[.]io` (Data enrichment)
- **PeeringDB:** `https[:]//www[.]peeringdb[.]com` (ASN ownership information)
- **Cloudflare Learning:** `https[:]//www[.]cloudflare[.]com/learning/network-layer/what-is-an-autonomous-system/` (Educational)
- **Huntress Blog:** `https[:]//www[.]huntress[.]com/blog` (Threat intelligence updates)