Skip to content

Commit 2f988c5

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3653 from splunk/ciscoios2018
CVE-2018-0171
2 parents 6826018 + 6a561d6 commit 2f988c5

16 files changed

+766
-9
lines changed

‎contentctl.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
uid: 3449
44
title: ES Content Updates
55
appid: DA-ESS-ContentUpdate
6-
version: 5.12.0
6+
version: 5.13.0
77
description: Explore the Analytic Stories included with ES Content Updates.
88
prefix: ESCU
99
label: ESCU
@@ -246,6 +246,11 @@ apps:
246246
appid: SPLUNK_ADD_ON_FOR_VMWARE_INDEXES
247247
version: 4.0.3
248248
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-indexes_403.tgz
249+
- uid: 1467
250+
title: Cisco Networks Add-on
251+
appid: TA-cisco_ios
252+
version: 2.7.8
253+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_278.tgz
249254
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
250255
test_data_caches:
251256
- base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/

‎data_sources/cisco_ios_logs.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Cisco IOS Logs
2+
id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f
3+
version: 1
4+
date: '2025-08-21'
5+
author: Michael Haag, Splunk
6+
description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG.
7+
source: cisco:ios
8+
sourcetype: cisco:ios
9+
separator: null
10+
supported_TA:
11+
- name: Cisco Networks Add-on
12+
url: https://splunkbase.splunk.com/app/1467
13+
version: 2.7.8
14+
fields:
15+
- _time
16+
- aci_message_text
17+
- action
18+
- app
19+
- authenticator
20+
- bytes
21+
- change_type
22+
- cipher
23+
- cisco_header
24+
- command
25+
- config_source
26+
- date_hour
27+
- date_mday
28+
- date_minute
29+
- date_month
30+
- date_second
31+
- date_wday
32+
- date_year
33+
- date_zone
34+
- dest
35+
- dest_interface
36+
- dest_mac
37+
- dest_port
38+
- device_time
39+
- direct_ap_mac
40+
- dvc
41+
- event_id
42+
- eventtype
43+
- facility
44+
- hmac
45+
- host
46+
- index
47+
- line
48+
- linecount
49+
- message_text
50+
- mnemonic
51+
- product
52+
- punct
53+
- reliable_time
54+
- severity
55+
- severity_description
56+
- severity_id
57+
- severity_id_and_name
58+
- severity_name
59+
- source
60+
- sourcetype
61+
- splunk_server
62+
- splunk_server_group
63+
- src
64+
- src_interface
65+
- src_ip
66+
- src_mac
67+
- subfacility
68+
- tag
69+
- tag::action
70+
- tag::app
71+
- tag::eventtype
72+
- timeendpos
73+
- timestartpos
74+
- transport
75+
- tty
76+
- type
77+
- user
78+
- vendor
79+
- vendor_action
80+
- vlan
81+
output_fields:
82+
- user
83+
- dest
84+
example_log: 'Aug 20 17:10:21.639: %AAA-6-USERNAME_CONFIGURATION: user with username: attacker configured
85+
Aug 20 17:10:21.664: %AAA-6-USER_PRIVILEGE_UPDATE: username: attacker privilege updated with priv-15
86+
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:username attacker privilege 15 secret *
87+
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:!config: USER TABLE MODIFIED'

‎detections/network/cisco_configuration_archive_logging_analysis.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Cisco Configuration Archive Logging Analysis
2+
id: f52d5c0b-d45d-4304-b300-a4f6a1130dec
3+
version: 1
4+
date: '2025-08-21'
5+
author: Bhavin Patel, Michael Haag, Splunk
6+
status: production
7+
type: Hunting
8+
description: This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
9+
data_source:
10+
- Cisco IOS Logs
11+
search: '| tstats `security_content_summariesonly` count values(All_Changes.command) as commands min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
12+
where (
13+
(All_Changes.command="*username*privilege 15*") OR
14+
(All_Changes.command="*username*password*") OR
15+
(All_Changes.command="*USER TABLE MODIFIED*") OR
16+
(All_Changes.command="*tftp-server*") OR
17+
(All_Changes.command="*snmp-server community*")
18+
)
19+
by All_Changes.dvc All_Changes.user
20+
| `drop_dm_object_name("All_Changes")`
21+
| rename dvc as dest
22+
| `security_content_ctime(firstTime)`
23+
| `security_content_ctime(lastTime)`
24+
| `cisco_configuration_archive_logging_analysis_filter`'
25+
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with configuration archive logging enabled. On Cisco devices, enable archive logging with the commands "archive" and "log config" in global configuration mode. Configure command logging with "archive log config logging enable" and ensure that the appropriate logging levels are set with "logging trap informational". The detection looks for patterns of suspicious configuration changes across sessions, focusing on account creation, SNMP modifications, and TFTP server configurations.
26+
known_false_positives: Legitimate configuration changes during routine maintenance or device setup may trigger this detection, especially when multiple related changes are made in a single session. Network administrators often make several configuration changes in sequence during maintenance windows. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames and scheduled maintenance windows. The detection includes a threshold (count > 2) to filter out isolated configuration changes, but this threshold may need to be adjusted based on your environment's normal activity patterns.
27+
references:
28+
- https://blog.talosintelligence.com/static-tundra/
29+
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
30+
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-mt/config-mgmt-15-mt-book/cm-config-logger.html
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$" and "$user$"
33+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View session details for - "$session_id$"
37+
search: '%original_detection_search% | search session_id = "$session_id$"'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
41+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
42+
"$user$") starthoursago=168 | stats count min(_time)
43+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
44+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
45+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
46+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
tags:
50+
analytic_story:
51+
- Cisco Smart Install Remote Code Execution CVE-2018-0171
52+
asset_type: Network
53+
mitre_attack_id:
54+
- T1562.001
55+
- T1098
56+
- T1505.003
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: network
62+
cve:
63+
- CVE-2018-0171
64+
tests:
65+
- name: True Positive Test
66+
attack_data:
67+
- data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
68+
sourcetype: cisco:ios
69+
source: cisco:ios

‎detections/network/cisco_ios_suspicious_privileged_account_creation.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Cisco IOS Suspicious Privileged Account Creation
2+
id: 63e3aff9-45d7-4d41-bcdb-9da561fb4533
3+
version: 1
4+
date: '2025-08-21'
5+
author: Bhavin Patel, Michael Haag, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This analytic detects the creation of privileged user accounts on Cisco IOS devices, which could indicate an attacker establishing backdoor access. The detection focuses on identifying when user accounts are created with privilege level 15 (the highest administrative privilege level in Cisco IOS) or when existing accounts have their privileges elevated. This type of activity is particularly concerning when performed by unauthorized users or during unusual hours, as it may represent a key step in establishing persistence following the exploitation of vulnerabilities like CVE-2018-0171 in Cisco Smart Install. Threat actors like Static Tundra have been observed creating privileged accounts as part of their attack chain after gaining initial access to network devices.
9+
data_source:
10+
- Cisco IOS Logs
11+
search: '| tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
12+
where (
13+
(All_Changes.command="*username * privilege 15*") OR
14+
(All_Changes.command="*username * password*" AND All_Changes.command="*USER TABLE MODIFIED*") OR
15+
(All_Changes.command="*USER_PRIVILEGE_UPDATE*priv-15*")
16+
)
17+
by All_Changes.dvc All_Changes.user
18+
| `drop_dm_object_name("All_Changes")`
19+
| rename dvc as dest
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
22+
| `cisco_ios_suspicious_privileged_account_creation_filter`'
23+
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel, with AAA accounting and command logging enabled on your Cisco devices.
24+
known_false_positives: Legitimate account creation and privilege elevation activities by authorized administrators will generate alerts with this detection. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for account management, and authorized administrators who regularly perform these actions. You may also want to create a lookup table of approved administrative accounts and filter out alerts for these accounts. Additionally, scheduled maintenance windows should be taken into account when evaluating alerts.
25+
references:
26+
- https://blog.talosintelligence.com/static-tundra/
27+
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
28+
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-a2.html#wp3796044403
29+
drilldown_searches:
30+
- name: View the detection results for - "$dest$"
31+
search: '%original_detection_search% | search dest = "$dest$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$dest$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time)
36+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
37+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
38+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
39+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
rba:
43+
message: A suspicious privileged account was created or modified on Cisco IOS device $dest$ by user $user$
44+
risk_objects:
45+
- field: dest
46+
type: system
47+
score: 50
48+
- field: user
49+
type: user
50+
score: 50
51+
threat_objects:
52+
- field: command
53+
type: command
54+
tags:
55+
analytic_story:
56+
- Cisco Smart Install Remote Code Execution CVE-2018-0171
57+
asset_type: Network
58+
mitre_attack_id:
59+
- T1136
60+
- T1078
61+
product:
62+
- Splunk Enterprise
63+
- Splunk Enterprise Security
64+
- Splunk Cloud
65+
security_domain: network
66+
cve:
67+
- CVE-2018-0171
68+
tests:
69+
- name: True Positive Test
70+
attack_data:
71+
- data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
72+
sourcetype: cisco:ios
73+
source: cisco:ios

‎detections/network/cisco_network_interface_modifications.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Cisco Network Interface Modifications
2+
id: 61ae09c2-079e-44b1-8be0-74e35c5a679e
3+
version: 1
4+
date: '2025-08-21'
5+
author: Bhavin Patel, Michael Haag, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.
9+
data_source:
10+
- Cisco IOS Logs
11+
search: '| tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
12+
where (
13+
(All_Changes.command="*interface*") OR
14+
(All_Changes.command="*LINEPROTO-5-UPDOWN*") OR
15+
(All_Changes.command="*ip address*")
16+
)
17+
by All_Changes.dvc All_Changes.user
18+
| `drop_dm_object_name("All_Changes")`
19+
| rename dvc as dest
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
22+
| `cisco_network_interface_modifications_filter`'
23+
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with appropriate logging levels enabled to capture interface configuration changes and line protocol state changes. Configure command logging on Cisco IOS devices using the "archive log config logging enable" command and ensure that syslog is properly configured to capture LINEPROTO-5-UPDOWN messages.
24+
known_false_positives: Legitimate network interface configuration changes may trigger this detection during routine network maintenance or initial device setup. Network administrators often need to create or modify interfaces as part of normal operations. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for interface configuration changes, and scheduled maintenance windows. You may also want to create a lookup table of approved interface naming conventions and filter out alerts for standard interface configurations.
25+
references:
26+
- https://blog.talosintelligence.com/static-tundra/
27+
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
28+
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-i1.html#wp1389942834
29+
drilldown_searches:
30+
- name: View the detection results for - "$dest$"
31+
search: '%original_detection_search% | search dest = "$dest$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$dest$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time)
36+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
37+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
38+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
39+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
rba:
43+
message: Suspicious network interface modifications detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment
44+
risk_objects:
45+
- field: dest
46+
type: system
47+
score: 55
48+
- field: user
49+
type: user
50+
score: 45
51+
threat_objects:
52+
- field: command
53+
type: command
54+
tags:
55+
analytic_story:
56+
- Cisco Smart Install Remote Code Execution CVE-2018-0171
57+
asset_type: Network
58+
mitre_attack_id:
59+
- T1556
60+
- T1021
61+
- T1133
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
security_domain: network
67+
cve:
68+
- CVE-2018-0171
69+
tests:
70+
- name: True Positive Test
71+
attack_data:
72+
- data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
73+
sourcetype: cisco:ios
74+
source: cisco:ios

‎detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco Secure Firewall - Intrusion Events by Threat Activity
22
id: b71e57e8-c571-4ff1-ae13-bc4384a9e891
3-
version: 2
4-
date: '2025-07-03'
3+
version: 3
4+
date: '2025-08-21'
55
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -16,7 +16,7 @@ description: |
1616
events that occur in close temporal proximity.
1717
1818
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
19-
19+
* Static Tundra
2020
* AgentTesla
2121
* Amadey
2222
* AsyncRAT
@@ -55,6 +55,7 @@ how_to_implement: |
5555
known_false_positives: False positives may occur due to legitimate security testing or research activities.
5656
references:
5757
- https://www.cisco.com/c/en/us/products/security/firewalls/index.html
58+
- https://blog.talosintelligence.com/static-tundra/
5859
drilldown_searches:
5960
- name: View the detection results for - "$dest_ip$"
6061
search: '%original_detection_search% | search dest_ip = "$dest_ip$"'

0 commit comments

Comments
 (0)