Skip to content

Commit 46c079b

Browse files
authored
Merge pull request #3535 from splunk/ftd-cim-update
Update Network CIM Analytics With FTD Data
2 parents 88d689f + 3393446 commit 46c079b

15 files changed

+597
-73
lines changed

data_sources/cisco_secure_firewall_threat_defense_connection_event.yml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco Secure Firewall Threat Defense Connection Event
22
id: 18878597-8f8a-4bca-a805-bfbe35e00032
3-
version: 1
4-
date: '2025-04-01'
3+
version: 2
4+
date: '2025-05-22'
55
author: Nasreddine Bencherchali, Splunk
66
description: Data source object for raw connection events from Cisco Secure Firewall
77
Threat Defense
@@ -114,7 +114,6 @@ output_fields:
114114
- dest_port
115115
- transport
116116
- rule
117-
- url
118117
- action
119118
example_log: '{"EventType":"ConnectionEvent", "FirstPacketSecond":1743500734, "DeviceUUID":"11bc8e94-f604-11ef-bcfe-eeb1de9c8a63",
120119
"InstanceID":1, "ConnectionID":259, "AC_RuleAction":"Block", "InitiatorIP":"172.16.3.110",
Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Cisco Secure Firewall - Remote Access Software Usage Traffic
2+
id: ac54d39e-a75d-4f42-971d-006db3a0423a
3+
version: 1
4+
date: '2025-05-02'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
The following analytic detects network traffic associated with known remote access software applications
10+
that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
11+
It leverages Cisco Secure Firewall Threat Defense Connection Event.
12+
This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
13+
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
14+
data, or deploy additional malware, posing a severe threat to the organization's security.
15+
data_source:
16+
- Cisco Secure Firewall Threat Defense Connection Event
17+
search: |
18+
`cisco_secure_firewall` EventType=ConnectionEvent
19+
| stats min(_time) as firstTime max(_time) as lastTime
20+
values(dest_port) as dest_port
21+
values(dest) as dest
22+
values(transport) as transport
23+
values(url) as url
24+
values(rule) as rule
25+
count by src_ip ClientApplication action
26+
| `security_content_ctime(firstTime)`
27+
| `security_content_ctime(lastTime)`
28+
| lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description
29+
| search category IN ("remote administration", "remote desktop control")
30+
| `remote_access_software_usage_exceptions`
31+
| `cisco_secure_firewall___remote_access_software_usage_traffic_filter`
32+
how_to_implement: |
33+
This search requires Cisco Secure Firewall Threat Defense Logs, which
34+
includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
35+
We strongly recommend that you specify your environment-specific configurations
36+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
37+
with configurations for your Splunk environment. The search also uses a post-filter
38+
macro designed to filter out known false positives.
39+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
40+
The access policy must also enable logging.
41+
The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
42+
that lets you track and maintain device- based exceptions for this set of detections.
43+
known_false_positives: |
44+
It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
45+
references:
46+
- https://attack.mitre.org/techniques/T1219/
47+
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
48+
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
49+
drilldown_searches:
50+
- name: View the detection results for - "$src_ip$"
51+
search: '%original_detection_search% | search src_ip = "$src_ip$"'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
- name: View risk events for the last 7 days for - "$src_ip$"
55+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$")
56+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
57+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
58+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
59+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
60+
| `security_content_ctime(lastTime)`'
61+
earliest_offset: $info_min_time$
62+
latest_offset: $info_max_time$
63+
rba:
64+
message: Traffic to known remote access software [$ClientApplication$] was detected from $src_ip$.
65+
risk_objects:
66+
- field: src_ip
67+
type: system
68+
score: 25
69+
threat_objects:
70+
- field: ClientApplication
71+
type: signature
72+
tags:
73+
analytic_story:
74+
- Insider Threat
75+
- Command And Control
76+
- Ransomware
77+
- Remote Monitoring and Management Software
78+
- Cisco Secure Firewall Threat Defense Analytics
79+
asset_type: Network
80+
mitre_attack_id:
81+
- T1219
82+
product:
83+
- Splunk Enterprise
84+
- Splunk Enterprise Security
85+
- Splunk Cloud
86+
security_domain: network
87+
manual_test: This detection uses A&I lookups from Enterprise Security.
88+
tests:
89+
- name: True Positive Test
90+
attack_data:
91+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
92+
source: not_applicable
93+
sourcetype: cisco:sfw:estreamer

detections/network/detect_outbound_ldap_traffic.yml

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Outbound LDAP Traffic
22
id: 5e06e262-d7cd-4216-b2f8-27b437e18458
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-05-22'
55
author: Bhavin Patel, Johan Bjerke, Splunk
66
status: production
77
type: Hunting
@@ -14,20 +14,21 @@ description: The following analytic identifies outbound LDAP traffic to external
1414
network compromise.
1515
data_source:
1616
- Palo Alto Network Traffic
17+
- Cisco Secure Firewall Threat Defense Connection Event
1718
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
1819
as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic
1920
where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip
2021
= 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12)
2122
by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
2223
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
2324
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
24-
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product |`drop_dm_object_name("All_Traffic")`
25+
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule |`drop_dm_object_name("All_Traffic")`
2526
| where src_ip != dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
2627
|`detect_outbound_ldap_traffic_filter`'
2728
how_to_implement: In order to properly run this search, Splunk needs to ingest data
28-
from Next Generation Firewalls like Palo Alto Networks Firewalls or other network
29-
control devices that mediate the traffic allowed into an environment. The search
30-
requires the Network_Traffic data model to be populated.
29+
from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls
30+
or other network control devices that mediate the traffic allowed into an environment.
31+
The search requires the Network_Traffic data model to be populated.
3132
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
3233
allowed outbound through your perimeter firewall. Please check those servers to
3334
verify if the activity is legitimate.
@@ -36,6 +37,7 @@ references:
3637
tags:
3738
analytic_story:
3839
- Log4Shell CVE-2021-44228
40+
- Cisco Secure Firewall Threat Defense Analytics
3941
asset_type: Endpoint
4042
cve:
4143
- CVE-2021-44228
@@ -48,8 +50,13 @@ tags:
4850
- Splunk Cloud
4951
security_domain: network
5052
tests:
51-
- name: True Positive Test
53+
- name: Palo Alto True Positive Test
5254
attack_data:
5355
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
5456
sourcetype: pan:traffic
5557
source: pan:traffic
58+
- name: Cisco Secure Firewall True Positive Test
59+
attack_data:
60+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
61+
source: not_applicable
62+
sourcetype: cisco:sfw:estreamer

detections/network/detect_outbound_smb_traffic.yml

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Outbound SMB Traffic
22
id: 1bed7774-304a-4e8f-9d72-d80e45ff492b
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-05-22'
55
author: Bhavin Patel, Stuart Hopkins, Patrick Bareiss
66
status: experimental
77
type: TTP
@@ -15,20 +15,21 @@ description: The following analytic detects outbound SMB (Server Message Block)
1515
full system compromise.
1616
data_source:
1717
- Zeek Conn
18+
- Cisco Secure Firewall Threat Defense Connection Event
1819
search: '| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time)
1920
as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app
2021
values(sourcetype) as sourcetype count from datamodel=Network_Traffic where (All_Traffic.action=allowed
2122
All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb")
2223
AND All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND NOT
2324
All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","100.64.0.0/10")
2425
by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
25-
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
26+
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
2627
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
27-
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` |
28+
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule | `drop_dm_object_name("All_Traffic")` |
2829
`security_content_ctime(start_time)` | `security_content_ctime(end_time)` | iplocation
2930
dest_ip | `detect_outbound_smb_traffic_filter`'
30-
how_to_implement: This search also requires you to be ingesting your network traffic
31-
and populating the Network_Traffic data model
31+
how_to_implement: This search requires you to be ingesting your network traffic
32+
and populating the Network_Traffic data model.
3233
known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic
3334
is legitimate, if the company's internal networks are not well-defined in the Assets
3435
and Identity Framework. Categorize the internal CIDR blocks as `internal` in the
@@ -52,6 +53,7 @@ tags:
5253
- Hidden Cobra Malware
5354
- DHS Report TA18-074A
5455
- NOBELIUM Group
56+
- Cisco Secure Firewall Threat Defense Analytics
5557
asset_type: Endpoint
5658
mitre_attack_id:
5759
- T1071.002
@@ -61,8 +63,13 @@ tags:
6163
- Splunk Cloud
6264
security_domain: network
6365
tests:
64-
- name: True Positive Test
66+
- name: Zeek True Positive Test
6567
attack_data:
6668
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log
6769
sourcetype: bro:conn:json
6870
source: conn.log
71+
- name: Cisco Secure Firewall True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
74+
source: not_applicable
75+
sourcetype: cisco:sfw:estreamer

detections/network/internal_horizontal_port_scan.yml

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
name: Internal Horizontal Port Scan
22
id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1
3-
version: 6
4-
date: '2025-05-02'
3+
version: 7
4+
date: '2025-05-22'
55
author: Dean Luxton
66
status: production
77
type: TTP
88
data_source:
99
- AWS CloudWatchLogs VPCflow
10+
- Cisco Secure Firewall Threat Defense Connection Event
1011
description: This analytic identifies instances where an internal host has attempted
1112
to communicate with 250 or more destination IP addresses using the same port and
1213
protocol. Horizontal port scans from internal hosts can indicate reconnaissance
@@ -17,7 +18,7 @@ search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as
1718
values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as
1819
dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port)
1920
as src_port count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
20-
by All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip span=1s _time All_Traffic.transport
21+
by All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport All_Traffic.rule span=1s _time
2122
| `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime |
2223
stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount
2324
values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone)
@@ -49,13 +50,16 @@ rba:
4950
message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
5051
IPs
5152
risk_objects:
52-
- field: src_ip
53+
- field: dest_ports
5354
type: system
5455
score: 64
55-
threat_objects: []
56+
threat_objects:
57+
- field: src_ip
58+
type: ip_address
5659
tags:
5760
analytic_story:
5861
- Network Discovery
62+
- Cisco Secure Firewall Threat Defense Analytics
5963
asset_type: Endpoint
6064
mitre_attack_id:
6165
- T1046
@@ -65,8 +69,13 @@ tags:
6569
- Splunk Cloud
6670
security_domain: network
6771
tests:
68-
- name: True Positive Test
72+
- name: AWS CloudWatch True Positive Test
6973
attack_data:
7074
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
7175
source: aws:cloudwatchlogs:vpcflow
7276
sourcetype: aws:cloudwatchlogs:vpcflow
77+
- name: Cisco Secure Firewall True Positive Test
78+
attack_data:
79+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
80+
source: not_applicable
81+
sourcetype: cisco:sfw:estreamer

detections/network/internal_horizontal_port_scan_nmap_top_20.yml

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
name: Internal Horizontal Port Scan NMAP Top 20
22
id: 3141a041-4f57-4277-9faa-9305ca1f8e5b
3-
version: 4
4-
date: '2025-05-02'
3+
version: 5
4+
date: '2025-05-22'
55
author: Dean Luxton
66
status: production
77
type: TTP
88
data_source:
99
- AWS CloudWatchLogs VPCflow
10+
- Cisco Secure Firewall Threat Defense Connection Event
1011
description: This analytic identifies instances where an internal host has attempted
1112
to communicate with 250 or more destination IP addresses using on of the NMAP top
1213
20 ports. Horizontal port scans from internal hosts can indicate reconnaissance
@@ -19,17 +20,17 @@ search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as
1920
as src_port count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
2021
AND All_Traffic.dest_port IN (21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443,
2122
445, 993, 995, 1723, 3306, 3389, 5900, 8080) by All_Traffic.src_ip All_Traffic.src
22-
All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.dest span=1s _time All_Traffic.transport |
23+
All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.dest All_Traffic.transport All_Traffic.rule span=1s _time |
2324
`drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime |
2425
stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount
25-
values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone)
26+
values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone)
2627
as src_zone by src_ip dest_port gtime transport | where totalDestIPCount>=250 |
2728
eval dest_port=transport + "/" + dest_port | stats min(_time) as _time values(action)
2829
as action sum(totalDestIPCount) as totalDestIPCount values(src_category) as src_category
2930
values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone)
3031
as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_nmap_top_20_filter`'
3132
how_to_implement: To properly run this search, Splunk needs to ingest data from networking
32-
telemetry sources such as firewalls, NetFlow, or host-based networking events. Ensure
33+
telemetry sources such as firewalls like Cisco Secure Firewall, NetFlow, or host-based networking events. Ensure
3334
that the Network_Traffic data model is populated to enable this search effectively.
3435
known_false_positives: Unknown
3536
references: []
@@ -51,13 +52,16 @@ rba:
5152
message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
5253
IPs
5354
risk_objects:
54-
- field: src_ip
55+
- field: dest_ports
5556
type: system
5657
score: 72
57-
threat_objects: []
58+
threat_objects:
59+
- field: src_ip
60+
type: ip_address
5861
tags:
5962
analytic_story:
6063
- Network Discovery
64+
- Cisco Secure Firewall Threat Defense Analytics
6165
asset_type: Endpoint
6266
mitre_attack_id:
6367
- T1046
@@ -67,8 +71,13 @@ tags:
6771
- Splunk Cloud
6872
security_domain: network
6973
tests:
70-
- name: True Positive Test
74+
- name: AWS CloudWatch True Positive Test
7175
attack_data:
7276
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
7377
source: aws:cloudwatchlogs:vpcflow
7478
sourcetype: aws:cloudwatchlogs:vpcflow
79+
- name: Cisco Secure Firewall True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
82+
source: not_applicable
83+
sourcetype: cisco:sfw:estreamer

0 commit comments

Comments
 (0)