Skip to content

Commit 6020d36

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into captcha
2 parents 3fb889d + 9eb9442 commit 6020d36

14 files changed

+1618
-4
lines changed

‎dashboards/threat_activity_by_snort_ids.json‎

Lines changed: 963 additions & 0 deletions
Large diffs are not rendered by default.

‎dashboards/threat_activity_by_snort_ids.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Threat Activity by Snort IDs
2+
id: 77d805c2-747e-4b78-8979-52deca44254f
3+
version: 1
4+
date: '2025-04-29'
5+
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
6+
description: Utilize this panel to correlate Snort intrusion events with known threat activity. Configure the Snort-ID-to-Threat lookup to enrich incoming signature data and populate the “Threat Activity by Snort IDs” view.

‎detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: WinEvent Windows Task Scheduler Event Action Started
22
id: b3632472-310b-11ec-9aab-acde48001122
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-05-19'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -32,7 +32,6 @@ tags:
3232
analytic_story:
3333
- Qakbot
3434
- Windows Persistence Techniques
35-
- Winter Vivern
3635
- Prestige Ransomware
3736
- DarkCrystal RAT
3837
- AsyncRAT

‎detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Cisco Secure Firewall - High Priority Intrusion Classification
2+
id: ec99bb81-c31b-4837-8c7d-1b32aa70b337
3+
version: 1
4+
date: '2025-04-28'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs.
10+
It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as:
11+
12+
- A Network Trojan was Detected
13+
- Successful Administrator Privilege Gain
14+
- Successful User Privilege Gain
15+
- Attempt to Login By a Default Username and Password
16+
- Known malware command and control traffic
17+
- Known malicious file or file based exploit
18+
- Known client side exploit attempt
19+
- Large Scale Information Leak"
20+
21+
These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
22+
data_source:
23+
- Cisco Secure Firewall Threat Defense Intrusion Event
24+
search: |
25+
`cisco_secure_firewall` EventType=IntrusionEvent
26+
class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak")
27+
| fillnull
28+
| stats count min(_time) as firstTime max(_time) as lastTime
29+
values(signature_id) as signature_id
30+
values(MitreAttackGroups) as MitreAttackGroups
31+
values(InlineResult) as InlineResult
32+
values(InlineResultReason) as InlineResultReason
33+
values(dest_port) as dest_port
34+
values(rule) as rule
35+
values(transport) as transport
36+
values(app) as app
37+
by src_ip, dest_ip, signature, class_desc
38+
| `security_content_ctime(firstTime)`
39+
| `security_content_ctime(lastTime)`
40+
| `cisco_secure_firewall___high_priority_intrusion_classification_filter`
41+
how_to_implement: |
42+
This search requires Cisco Secure Firewall Threat Defense Logs, which
43+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
44+
We strongly recommend that you specify your environment-specific configurations
45+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
46+
with configurations for your Splunk environment. The search also uses a post-filter
47+
macro designed to filter out known false positives.
48+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
49+
The intrusion access policy must also be configured.
50+
known_false_positives: Some intrusion events that are linked to these classifications might be noisy in certain environments. Apply a combination of filters for specific snort IDs and other indicators.
51+
references:
52+
- https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
53+
drilldown_searches:
54+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
55+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
56+
earliest_offset: $info_min_time$
57+
latest_offset: $info_max_time$
58+
- name: View risk events for the last 7 days for - "$dest_ip$"
59+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
60+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
61+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
62+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
63+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
64+
earliest_offset: $info_min_time$
65+
latest_offset: $info_max_time$
66+
rba:
67+
message: A high priority intrusion event with classification ($class_desc$) was detected from $src_ip$ to $dest_ip$, indicating potential suspicious activity.
68+
risk_objects:
69+
- field: dest_ip
70+
type: system
71+
score: 25
72+
threat_objects:
73+
- field: signature
74+
type: signature
75+
- field: src_ip
76+
type: ip_address
77+
tags:
78+
analytic_story:
79+
- Cisco Secure Firewall Threat Defense Analytics
80+
asset_type: Network
81+
security_domain: network
82+
mitre_attack_id:
83+
- T1203
84+
- T1003
85+
- T1071
86+
- T1190
87+
- T1078
88+
product:
89+
- Splunk Enterprise
90+
- Splunk Cloud
91+
- Splunk Enterprise Security
92+
tests:
93+
- name: True Positive Test
94+
attack_data:
95+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events.log
96+
source: not_applicable
97+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Cisco Secure Firewall - Intrusion Events by Threat Activity
2+
id: b71e57e8-c571-4ff1-ae13-bc4384a9e891
3+
version: 1
4+
date: '2025-05-12'
5+
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
11+
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
12+
lookup table (cisco_snort_ids_to_threat_mapping.csv) to map Snort signature IDs to known threat actors and their techniques.
13+
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
14+
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
15+
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
16+
events that occur in close temporal proximity.
17+
data_source:
18+
- Cisco Secure Firewall Threat Defense Intrusion Event
19+
search: |
20+
`cisco_secure_firewall` EventType=IntrusionEvent
21+
| stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip signature_id
22+
| lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message
23+
| where isnotnull(threat)
24+
| bin _time span=1d
25+
| stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip threat
26+
| lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids
27+
| table _time, dest_ip, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app
28+
| where sig_count >= distinct_count_snort_ids
29+
| `cisco_secure_firewall___intrusion_events_by_threat_activity_filter`
30+
how_to_implement: |
31+
This search requires Cisco Secure Firewall Threat Defense Logs, which
32+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
33+
We strongly recommend that you specify your environment-specific configurations
34+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
35+
with configurations for your Splunk environment. The search also uses a post-filter
36+
macro designed to filter out known false positives.
37+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
38+
The intrusion access policy must also be configured. This detection is based on the cisco_snort_ids_to_threat_mapping.csv mapping file - please update the lookup file with the latest Snort IDs to Threat Actors if you would like to modify the distinct count of Snort IDs needed to trigger the detection or if you would like to add new Snort IDs to Threat Actors.
39+
known_false_positives: False positives may occur due to legitimate security testing or research activities.
40+
references:
41+
- https://www.cisco.com/c/en/us/products/security/firewalls/index.html
42+
drilldown_searches:
43+
- name: View the detection results for - "$dest_ip$"
44+
search: '%original_detection_search% | search dest_ip = "$dest_ip$"'
45+
earliest_offset: $info_min_time$
46+
latest_offset: $info_max_time$
47+
- name: View risk events for the last 7 days for - "$dest_ip$""
48+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
49+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
50+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
51+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
52+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
53+
earliest_offset: $info_min_time$
54+
latest_offset: $info_max_time$
55+
rba:
56+
message: Potential $threat$ activity detected from $src_ip$ to $dest_ip$.
57+
risk_objects:
58+
- field: dest_ip
59+
type: system
60+
score: 50
61+
threat_objects:
62+
- field: signature
63+
type: signature
64+
tags:
65+
analytic_story:
66+
- Cisco Secure Firewall Threat Defense Analytics
67+
asset_type: Network
68+
security_domain: network
69+
mitre_attack_id:
70+
- T1041
71+
- T1573.002
72+
product:
73+
- Splunk Enterprise
74+
- Splunk Cloud
75+
- Splunk Enterprise Security
76+
tests:
77+
- name: True Positive Test
78+
attack_data:
79+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
80+
source: not_applicable
81+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___lumma_stealer_activity.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Cisco Secure Firewall - Lumma Stealer Activity
2+
id: 96bce783-c22e-4e48-8cf1-3eb2794c5083
3+
version: 1
4+
date: '2025-04-28'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four of the following Snort signature IDs 64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811 occurs in the span of 15 minutes from the same host.
11+
If confirmed malicious, this behavior is highly indicative of a successful infection of Lumma Stealer.
12+
data_source:
13+
- Cisco Secure Firewall Threat Defense Intrusion Event
14+
search: |
15+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811)
16+
| bin _time span=15m
17+
| fillnull
18+
| stats dc(signature_id) as unique_signature_count
19+
values(signature_id) as signature_id
20+
values(signature) as signature
21+
values(class_desc) as class_desc
22+
values(MitreAttackGroups) as MitreAttackGroups
23+
values(InlineResult) as InlineResult
24+
values(InlineResultReason) as InlineResultReason
25+
values(dest_ip) as dest_ip
26+
values(dest_port) as dest_port
27+
values(rule) as rule
28+
values(transport) as transport
29+
values(app) as app
30+
min(_time) as firstTime
31+
max(_time) as lastTime
32+
by src_ip
33+
| where unique_signature_count >= 3
34+
| `security_content_ctime(firstTime)`
35+
| `security_content_ctime(lastTime)`
36+
| `cisco_secure_firewall___lumma_stealer_activity_filter`
37+
how_to_implement: |
38+
This search requires Cisco Secure Firewall Threat Defense Logs, which
39+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
40+
We strongly recommend that you specify your environment-specific configurations
41+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
42+
with configurations for your Splunk environment. The search also uses a post-filter
43+
macro designed to filter out known false positives.
44+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
45+
The intrusion access policy must also be configured.
46+
known_false_positives: False positives should be very unlikely.
47+
references:
48+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
49+
drilldown_searches:
50+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
51+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
- name: View risk events for the last 7 days for - "$dest_ip$"
55+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
56+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
57+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
58+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
59+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
60+
earliest_offset: $info_min_time$
61+
latest_offset: $info_max_time$
62+
rba:
63+
message: Lumma Stealer Activity on host $dest_ip$ origniating from $src_ip$
64+
risk_objects:
65+
- field: dest_ip
66+
type: system
67+
score: 25
68+
threat_objects:
69+
- field: signature
70+
type: signature
71+
- field: src_ip
72+
type: ip_address
73+
tags:
74+
analytic_story:
75+
- Cisco Secure Firewall Threat Defense Analytics
76+
- Lumma Stealer
77+
asset_type: Network
78+
security_domain: network
79+
mitre_attack_id:
80+
- T1190
81+
- T1210
82+
- T1027
83+
- T1204
84+
product:
85+
- Splunk Enterprise
86+
- Splunk Cloud
87+
- Splunk Enterprise Security
88+
tests:
89+
- name: True Positive Test
90+
attack_data:
91+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
92+
source: not_applicable
93+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Cisco Secure Firewall - Lumma Stealer Download Attempt
2+
id: 66f22f52-fbae-4be7-a263-561dacb63613
3+
version: 1
4+
date: '2025-04-26'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
11+
data_source:
12+
- Cisco Secure Firewall Threat Defense Intrusion Event
13+
search: |
14+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64810, 64811)
15+
| fillnull
16+
| stats min(_time) as firstTime max(_time) as lastTime
17+
by src_ip dest_ip dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
18+
| `security_content_ctime(firstTime)`
19+
| `security_content_ctime(lastTime)`
20+
| `cisco_secure_firewall___lumma_stealer_download_attempt_filter`
21+
how_to_implement: |
22+
This search requires Cisco Secure Firewall Threat Defense Logs, which
23+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
24+
We strongly recommend that you specify your environment-specific configurations
25+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
26+
with configurations for your Splunk environment. The search also uses a post-filter
27+
macro designed to filter out known false positives.
28+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
29+
The intrusion access policy must also be configured.
30+
known_false_positives: False positives should be unlikely.
31+
references:
32+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
33+
drilldown_searches:
34+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
35+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
- name: View risk events for the last 7 days for - "$dest_ip$"
39+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
40+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
41+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
42+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
43+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: Lumma Stealer Download Attempt detected on host $dest_ip$ origniating from $src_ip$
48+
risk_objects:
49+
- field: dest_ip
50+
type: system
51+
score: 25
52+
threat_objects:
53+
- field: signature
54+
type: signature
55+
- field: src_ip
56+
type: ip_address
57+
tags:
58+
analytic_story:
59+
- Cisco Secure Firewall Threat Defense Analytics
60+
- Lumma Stealer
61+
asset_type: Network
62+
security_domain: network
63+
mitre_attack_id:
64+
- T1041
65+
- T1573.002
66+
product:
67+
- Splunk Enterprise
68+
- Splunk Cloud
69+
- Splunk Enterprise Security
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
74+
source: not_applicable
75+
sourcetype: cisco:sfw:estreamer

0 commit comments

Comments
 (0)