Skip to content

Commit 0227a4f

Browse files
nasbenchnasbench
authored
Add Oracle Exploitation Snort Coverage (#3742)
* add oracle snort coverage * fix refs * Update cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
1 parent 7c092c7 commit 0227a4f

File tree

3 files changed

+236
-0
lines changed

3 files changed

+236
-0
lines changed

‎detections/network/cisco_secure_firewall___oracle_e_business_suite_correlation.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Cisco Secure Firewall - Oracle E-Business Suite Correlation
2+
id: 9e995d21-6870-43de-acd9-76f372bcf323
3+
version: 1
4+
date: '2025-10-23'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: TTP
8+
description: |
9+
This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs.
10+
The detection looks for specific signatures that indicate attempts to exploit the TemplatePreview functionality and vulnerable SyncServlet endpoints as well as post compromise activity involving Cl0p.
11+
By correlating these signatures, the analytic aims to identify coordinated exploitation attempts that may indicate an attacker is targeting Oracle E-Business Suite installations.
12+
Security teams should investigate any instances of these correlated signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
13+
data_source:
14+
- Cisco Secure Firewall Threat Defense Intrusion Event
15+
search: |
16+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (65454, 65455, 65377, 65378, 65413, 65414, 65415, 65456)
17+
| bin _time span=5m
18+
| fillnull
19+
| stats dc(signature_id) as unique_signature_count
20+
values(signature_id) as signature_id
21+
values(signature) as signature
22+
values(class_desc) as class_desc
23+
values(MitreAttackGroups) as MitreAttackGroups
24+
values(InlineResult) as InlineResult
25+
values(InlineResultReason) as InlineResultReason
26+
values(dest_port) as dest_port
27+
values(rule) as rule
28+
values(transport) as transport
29+
values(app) as app
30+
min(_time) as firstTime
31+
max(_time) as lastTime
32+
sum(eval(signature_id==65454)) as sig_template_preview
33+
sum(eval(signature_id==65455)) as sig_sync_servlet
34+
sum(eval(signature_id IN (65377,65378,65413,65414,65415,65456))) as sig_exploit_activity
35+
by src_ip dest_ip
36+
| where (
37+
(
38+
sig_exploit_activity >= 1
39+
AND
40+
(
41+
sig_template_preview >= 1
42+
OR
43+
sig_sync_servlet >= 1
44+
)
45+
)
46+
OR
47+
(
48+
sig_template_preview >= 1
49+
AND
50+
sig_sync_servlet >= 1
51+
)
52+
OR
53+
unique_signature_count >= 2
54+
)
55+
| `security_content_ctime(firstTime)`
56+
| `security_content_ctime(lastTime)`
57+
| `cisco_secure_firewall___oracle_e_business_suite_correlation_filter`
58+
how_to_implement: |
59+
This search requires Cisco Secure Firewall Threat Defense Logs, which
60+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
61+
We strongly recommend that you specify your environment-specific configurations
62+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
63+
with configurations for your Splunk environment. The search also uses a post-filter
64+
macro designed to filter out known false positives.
65+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
66+
The intrusion access policy must also be configured.
67+
known_false_positives: False positives should be very unlikely.
68+
references:
69+
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
70+
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
71+
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
72+
- https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
73+
drilldown_searches:
74+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
75+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
76+
earliest_offset: $info_min_time$
77+
latest_offset: $info_max_time$
78+
- name: View risk events for the last 7 days for - "$dest_ip$"
79+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
80+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
81+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
82+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
83+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
84+
earliest_offset: $info_min_time$
85+
latest_offset: $info_max_time$
86+
rba:
87+
message: Multiple Oracle E-Business Suite exploitation signatures $signature_id$ detected from source IP $src_ip$ to destination IP $dest_ip$
88+
risk_objects:
89+
- field: dest_ip
90+
type: system
91+
score: 25
92+
threat_objects:
93+
- field: signature
94+
type: signature
95+
- field: src_ip
96+
type: ip_address
97+
tags:
98+
analytic_story:
99+
- Cisco Secure Firewall Threat Defense Analytics
100+
- Oracle E-Business Suite Exploitation
101+
asset_type: Network
102+
cve:
103+
- CVE-2025-61882
104+
- CVE-2025-61884
105+
security_domain: network
106+
mitre_attack_id:
107+
- T1190
108+
product:
109+
- Splunk Enterprise
110+
- Splunk Cloud
111+
- Splunk Enterprise Security
112+
tests:
113+
- name: True Positive Test
114+
attack_data:
115+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite.log
116+
source: not_applicable
117+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___oracle_e_business_suite_exploitation.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Cisco Secure Firewall - Oracle E-Business Suite Exploitation
2+
id: 1c077b8a-95a3-4692-980d-c72fc50e9930
3+
version: 1
4+
date: '2025-04-26'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884.
10+
SIDs 65413-65415 detect detect Java.Backdoor.Cl0p variant payload downloads and Java.Backdoor.Cl0p outbound
11+
command-and-control connection attempts.
12+
SIDs 65456, 65377 and 65378 detect attempts to exploit these vulnerabilities.
13+
Security teams should investigate any instances of these signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
14+
data_source:
15+
- Cisco Secure Firewall Threat Defense Intrusion Event
16+
search: |
17+
`cisco_secure_firewall`
18+
EventType=IntrusionEvent
19+
signature_id IN (65377, 65378, 65413, 65414, 65415, 65456)
20+
| fillnull
21+
| stats values(signature_id) as signature_id
22+
values(signature) as signature
23+
values(class_desc) as class_desc
24+
values(MitreAttackGroups) as MitreAttackGroups
25+
values(InlineResult) as InlineResult
26+
values(InlineResultReason) as InlineResultReason
27+
values(dest_port) as dest_port
28+
values(rule) as rule
29+
values(transport) as transport
30+
values(app) as app
31+
min(_time) as firstTime
32+
max(_time) as lastTime
33+
by src_ip dest_ip
34+
| `security_content_ctime(firstTime)`
35+
| `security_content_ctime(lastTime)`
36+
| `cisco_secure_firewall___oracle_e_business_suite_exploitation_filter`
37+
how_to_implement: |
38+
This search requires Cisco Secure Firewall Threat Defense Logs, which
39+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
40+
We strongly recommend that you specify your environment-specific configurations
41+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
42+
with configurations for your Splunk environment. The search also uses a post-filter
43+
macro designed to filter out known false positives.
44+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
45+
The intrusion access policy must also be configured.
46+
known_false_positives: False positives should be unlikely.
47+
references:
48+
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
49+
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
50+
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
51+
- https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
52+
drilldown_searches:
53+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
54+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
55+
earliest_offset: $info_min_time$
56+
latest_offset: $info_max_time$
57+
- name: View risk events for the last 7 days for - "$dest_ip$"
58+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
59+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
60+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
61+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
62+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
63+
earliest_offset: $info_min_time$
64+
latest_offset: $info_max_time$
65+
rba:
66+
message: Network activity associated with Oracle E-Business Suite exploitation detected from source IP $src_ip$ to destination IP $dest_ip$.
67+
risk_objects:
68+
- field: dest_ip
69+
type: system
70+
score: 25
71+
threat_objects:
72+
- field: signature
73+
type: signature
74+
- field: src_ip
75+
type: ip_address
76+
tags:
77+
analytic_story:
78+
- Cisco Secure Firewall Threat Defense Analytics
79+
- Oracle E-Business Suite Exploitation
80+
asset_type: Network
81+
security_domain: network
82+
mitre_attack_id:
83+
- T1190
84+
product:
85+
- Splunk Enterprise
86+
- Splunk Cloud
87+
- Splunk Enterprise Security
88+
tests:
89+
- name: True Positive Test
90+
attack_data:
91+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite.log
92+
source: not_applicable
93+
sourcetype: cisco:sfw:estreamer

‎stories/oracle_e_business_suite_exploitation.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Oracle E-Business Suite Exploitation
2+
id: 3d34b43e-204a-4a57-895f-1aafaefdbcb8
3+
version: 1
4+
date: '2025-10-23'
5+
author: Nasreddine Bencherchali, splunk
6+
status: production
7+
description: |
8+
Leverage searches that allow you to detect and investigate unusual activities
9+
that might relate to the exploitation of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884).
10+
narrative: |
11+
This story addresses Oracle E-Business Suite exploitation. This story focuses on the detection of exploitation attempts
12+
targeting Oracle E-Business Suite vulnerabilities, specifically CVE-2025-61882 and CVE-2025-61884. These vulnerabilities have been actively exploited in the wild,
13+
allowing attackers to execute arbitrary code on vulnerable systems. The story provides analytics to help security operations centers (SOCs) and security researchers monitor and respond to potential exploitation attempts.
14+
references:
15+
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
16+
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
17+
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
18+
- https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
19+
tags:
20+
category:
21+
- Adversary Tactics
22+
product:
23+
- Splunk Enterprise
24+
- Splunk Enterprise Security
25+
- Splunk Cloud
26+
usecase: Advanced Threat Detection

0 commit comments

Comments
 (0)