The conversion to KQL does not account for the difference between IP v4 and v6.
Example:
Rule converted to KQL
DeviceNetworkEvents | where (InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe") and (not(((ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "169.254.0.0/16") or ipv4_is_in_range(RemoteIP, "::1/128") or ipv4_is_in_range(RemoteIP, "fe80::/10") or ipv4_is_in_range(RemoteIP, "fc00::/7")) or ipv4_is_in_range(RemoteIP, "20.0.0.0/11"))))
First issue: The function ipv4_is_in_range() is used for ipv6.
Second issue: The RemoteIP could have either ipv4 or ipv6 and only ipv4_is_in_range() is used.
Suggested fix:
Use ipv6_is_match() in all cases, since it accounts for ipv4 and v6 at the same time.
Edit
The working version of the query:
DeviceNetworkEvents | where (InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe") and (not(((ipv6_is_match(RemoteIP, "127.0.0.0/8") or ipv6_is_match(RemoteIP, "10.0.0.0/8") or ipv6_is_match(RemoteIP, "172.16.0.0/12") or ipv6_is_match(RemoteIP, "192.168.0.0/16") or ipv6_is_match(RemoteIP, "169.254.0.0/16") or ipv6_is_match(RemoteIP, "::1/128") or ipv6_is_match(RemoteIP, "fe80::/10") or ipv6_is_match(RemoteIP, "fc00::/7") ) or ipv6_is_match(RemoteIP, "20.0.0.0/11"))))
The conversion to KQL does not account for the difference between IP v4 and v6.
Example:
Rule converted to KQL
DeviceNetworkEvents | where (InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe") and (not(((ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "169.254.0.0/16") or ipv4_is_in_range(RemoteIP, "::1/128") or ipv4_is_in_range(RemoteIP, "fe80::/10") or ipv4_is_in_range(RemoteIP, "fc00::/7")) or ipv4_is_in_range(RemoteIP, "20.0.0.0/11"))))First issue: The function ipv4_is_in_range() is used for ipv6.
Second issue: The RemoteIP could have either ipv4 or ipv6 and only ipv4_is_in_range() is used.
Suggested fix:
Use ipv6_is_match() in all cases, since it accounts for ipv4 and v6 at the same time.
Edit
The working version of the query:
DeviceNetworkEvents | where (InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe") and (not(((ipv6_is_match(RemoteIP, "127.0.0.0/8") or ipv6_is_match(RemoteIP, "10.0.0.0/8") or ipv6_is_match(RemoteIP, "172.16.0.0/12") or ipv6_is_match(RemoteIP, "192.168.0.0/16") or ipv6_is_match(RemoteIP, "169.254.0.0/16") or ipv6_is_match(RemoteIP, "::1/128") or ipv6_is_match(RemoteIP, "fe80::/10") or ipv6_is_match(RemoteIP, "fc00::/7") ) or ipv6_is_match(RemoteIP, "20.0.0.0/11"))))