|
| 1 | +name: Cisco Secure Firewall - Remote Access Software Usage Traffic |
| 2 | +id: ac54d39e-a75d-4f42-971d-006db3a0423a |
| 3 | +version: 1 |
| 4 | +date: '2025-05-02' |
| 5 | +author: Nasreddine Bencherchali, Splunk |
| 6 | +status: production |
| 7 | +type: Anomaly |
| 8 | +description: | |
| 9 | + The following analytic detects network traffic associated with known remote access software applications |
| 10 | + that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. |
| 11 | + It leverages Cisco Secure Firewall Threat Defense Connection Event. |
| 12 | + This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. |
| 13 | + If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate |
| 14 | + data, or deploy additional malware, posing a severe threat to the organization's security. |
| 15 | +data_source: |
| 16 | +- Cisco Secure Firewall Threat Defense Connection Event |
| 17 | +search: | |
| 18 | + `cisco_secure_firewall` EventType=ConnectionEvent |
| 19 | + | stats min(_time) as firstTime max(_time) as lastTime |
| 20 | + values(dest_port) as dest_port |
| 21 | + values(dest) as dest |
| 22 | + values(transport) as transport |
| 23 | + values(url) as url |
| 24 | + values(rule) as rule |
| 25 | + count by src_ip ClientApplication action |
| 26 | + | `security_content_ctime(firstTime)` |
| 27 | + | `security_content_ctime(lastTime)` |
| 28 | + | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description |
| 29 | + | search category IN ("remote administration", "remote desktop control") |
| 30 | + | `remote_access_software_usage_exceptions` |
| 31 | + | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` |
| 32 | +how_to_implement: | |
| 33 | + This search requires Cisco Secure Firewall Threat Defense Logs, which |
| 34 | + includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. |
| 35 | + We strongly recommend that you specify your environment-specific configurations |
| 36 | + (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition |
| 37 | + with configurations for your Splunk environment. The search also uses a post-filter |
| 38 | + macro designed to filter out known false positives. |
| 39 | + The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). |
| 40 | + The access policy must also enable logging. |
| 41 | + The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" |
| 42 | + that lets you track and maintain device- based exceptions for this set of detections. |
| 43 | +known_false_positives: | |
| 44 | + It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content |
| 45 | +references: |
| 46 | +- https://attack.mitre.org/techniques/T1219/ |
| 47 | +- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ |
| 48 | +- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ |
| 49 | +drilldown_searches: |
| 50 | +- name: View the detection results for - "$src_ip$" |
| 51 | + search: '%original_detection_search% | search src_ip = "$src_ip$"' |
| 52 | + earliest_offset: $info_min_time$ |
| 53 | + latest_offset: $info_max_time$ |
| 54 | +- name: View risk events for the last 7 days for - "$src_ip$" |
| 55 | + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") |
| 56 | + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime |
| 57 | + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) |
| 58 | + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) |
| 59 | + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` |
| 60 | + | `security_content_ctime(lastTime)`' |
| 61 | + earliest_offset: $info_min_time$ |
| 62 | + latest_offset: $info_max_time$ |
| 63 | +rba: |
| 64 | + message: Traffic to known remote access software [$ClientApplication$] was detected from $src_ip$. |
| 65 | + risk_objects: |
| 66 | + - field: src_ip |
| 67 | + type: system |
| 68 | + score: 25 |
| 69 | + threat_objects: |
| 70 | + - field: ClientApplication |
| 71 | + type: signature |
| 72 | +tags: |
| 73 | + analytic_story: |
| 74 | + - Insider Threat |
| 75 | + - Command And Control |
| 76 | + - Ransomware |
| 77 | + - Remote Monitoring and Management Software |
| 78 | + - Cisco Secure Firewall Threat Defense Analytics |
| 79 | + asset_type: Network |
| 80 | + mitre_attack_id: |
| 81 | + - T1219 |
| 82 | + product: |
| 83 | + - Splunk Enterprise |
| 84 | + - Splunk Enterprise Security |
| 85 | + - Splunk Cloud |
| 86 | + security_domain: network |
| 87 | + manual_test: This detection uses A&I lookups from Enterprise Security. |
| 88 | +tests: |
| 89 | +- name: True Positive Test |
| 90 | + attack_data: |
| 91 | + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log |
| 92 | + source: not_applicable |
| 93 | + sourcetype: cisco:sfw:estreamer |
0 commit comments