Skip to content

Commit 8b20564

Browse files
authored
Merge branch 'develop' into GhostRedirector
2 parents b647bfa + eb4400c commit 8b20564

13 files changed

+360
-14
lines changed

contentctl.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -249,8 +249,8 @@ apps:
249249
- uid: 1467
250250
title: Cisco Networks Add-on
251251
appid: TA-cisco_ios
252-
version: 2.7.8
253-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_278.tgz
252+
version: 2.7.9
253+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz
254254
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
255255
test_data_caches:
256256
- base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/

data_sources/cisco_asa_logs.yml

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
name: Cisco ASA Logs
2+
id: 3f2a9b6d-1c8e-4f7b-a2d3-8b7f1c2a9d4e
3+
version: 1
4+
date: '2025-09-23'
5+
author: Bhavin Patel, Splunk
6+
description: >
7+
Data source object for Cisco ASA system logs. Cisco ASA logs provide firewall
8+
operational and security telemetry (connection events, ACL denies, VPN events,
9+
NAT translations, and device health). Deploy the Splunk Add-on for Cisco ASA
10+
(TA-cisco_asa) on indexers/heavy forwarders and the Cisco ASA App on search
11+
heads for best parsing, CIM mapping, and dashboards. This data is ingested via SYSLOG. You must be ingesting Cisco ASA syslog data into your Splunk environment. To ensure all detections work, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. A few analytics are designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
12+
source: cisco:asa
13+
sourcetype: cisco:asa
14+
separator: null
15+
supported_TA:
16+
- name: Cisco Security Cloud
17+
url: https://splunkbase.splunk.com/app/7404
18+
version: 3.4.1
19+
fields:
20+
- Cisco_ASA_action
21+
- Cisco_ASA_message_id
22+
- Cisco_ASA_user
23+
- Cisco_ASA_vendor_action
24+
- IP
25+
- Username
26+
- _bkt
27+
- _cd
28+
- _eventtype_color
29+
- _indextime
30+
- _raw
31+
- _serial
32+
- _si
33+
- _sourcetype
34+
- _time
35+
- acl
36+
- action
37+
- app
38+
- assigned_ip
39+
- bytes
40+
- category
41+
- command
42+
- communication_protocol
43+
- connections_in_use
44+
- date_hour
45+
- date_mday
46+
- date_minute
47+
- date_month
48+
- date_second
49+
- date_wday
50+
- date_year
51+
- date_zone
52+
- dest
53+
- dest_host
54+
- dest_interface
55+
- dest_ip
56+
- dest_nt_domain
57+
- dest_port
58+
- dest_public_port
59+
- dest_translated_host
60+
- dest_translated_ip
61+
- dest_translated_port
62+
- dest_user
63+
- dest_zone
64+
- direction
65+
- duration
66+
- duration_day
67+
- duration_hour
68+
- duration_minute
69+
- duration_second
70+
- dvc
71+
- eventtype
72+
- group
73+
- host
74+
- ids_type
75+
- index
76+
- laction
77+
- linecount
78+
- most_used_connections
79+
- object
80+
- object_attrs
81+
- object_category
82+
- object_id
83+
- product
84+
- protocol
85+
- protocol_version
86+
- punct
87+
- reason
88+
- result
89+
- rule
90+
- rule_name
91+
- session_id
92+
- severity
93+
- signature
94+
- signature_id
95+
- source
96+
- sourcetype
97+
- splunk_server
98+
- splunk_server_group
99+
- src
100+
- src_host
101+
- src_interface
102+
- src_ip
103+
- src_nt_domain
104+
- src_port
105+
- src_public_port
106+
- src_translated_host
107+
- src_translated_ip
108+
- src_translated_port
109+
- src_user
110+
- src_zone
111+
- ssl_is_valid
112+
- status
113+
- tag
114+
- tag::action
115+
- tag::app
116+
- tag::eventtype
117+
- tag::object_category
118+
- teardown_initiator
119+
- timeendpos
120+
- timestartpos
121+
- transport
122+
- type
123+
- user
124+
- vendor
125+
- vendor_action
126+
- vendor_product
127+
- vendor_severity
128+
- zone
129+
example_log: >
130+
Sep 23 19:27:50 18.144.133.67 :2025-09-23T19:27:49Z: %ASA-session-7-609002: Teardown local-host management:54.245.234.201 duration 0:02:01
131+
Sep 23 18:07:00 18.144.133.67 :2025-09-23T18:07:00Z: %ASA-session-7-710005: TCP request discarded from 198.27.166.158/55508 to management:172.31.12.229/443

data_sources/cisco_ios_logs.yml

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,22 @@ id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f
33
version: 1
44
date: '2025-08-21'
55
author: Michael Haag, Splunk
6-
description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG.
6+
description: Data source object for Cisco IOS system logs. Cisco IOS logs provide
7+
operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS
8+
XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes
9+
these events by setting proper sourcetypes and extracting fields for switches, routers,
10+
controllers, and access points; deploy the TA on indexers/HFs and search heads,
11+
and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include
12+
Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent
13+
investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This
14+
data is ingested via SYSLOG.
715
source: cisco:ios
816
sourcetype: cisco:ios
917
separator: null
1018
supported_TA:
1119
- name: Cisco Networks Add-on
1220
url: https://splunkbase.splunk.com/app/1467
13-
version: 2.7.8
21+
version: 2.7.9
1422
fields:
1523
- _time
1624
- aci_message_text
@@ -81,7 +89,8 @@ fields:
8189
output_fields:
8290
- user
8391
- dest
84-
example_log: 'Aug 20 17:10:21.639: %AAA-6-USERNAME_CONFIGURATION: user with username: attacker configured
85-
Aug 20 17:10:21.664: %AAA-6-USER_PRIVILEGE_UPDATE: username: attacker privilege updated with priv-15
86-
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:username attacker privilege 15 secret *
87-
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:!config: USER TABLE MODIFIED'
92+
example_log: 'Aug 20 17:10:21.639: %AAA-6-USERNAME_CONFIGURATION: user with username:
93+
attacker configured Aug 20 17:10:21.664: %AAA-6-USER_PRIVILEGE_UPDATE: username:
94+
attacker privilege updated with priv-15 Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD:
95+
User:ec2-user logged command:username attacker privilege 15 secret * Aug 20 17:10:21.665:
96+
%PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:!config: USER TABLE MODIFIED'
Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Cisco ASA - Core Syslog Message Volume Drop
2+
id: 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
3+
version: 2
4+
date: '2025-09-25'
5+
author: Bhavin Patel, Micheal Haag, Splunk
6+
status: production
7+
type: Hunting
8+
description: |
9+
Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise.
10+
data_source:
11+
- Cisco ASA Logs
12+
search: |
13+
`cisco_asa`
14+
| rex "%ASA-[^-]+-\d+-(?<message_id>\d+):"
15+
| search message_id IN (302013,302014,609002,710005)
16+
| eval msg_desc=case(
17+
message_id="302013","Built inbound TCP connection",
18+
message_id="302014","Teardown TCP connection",
19+
message_id="609002","Teardown local-host management",
20+
message_id="710005","TCP request discarded"
21+
)
22+
| bin _time span=15m
23+
| stats count values(msg_desc) as message_description values(host) as host by _time message_id
24+
| xyseries _time message_id count
25+
| `cisco_asa___core_syslog_message_volume_drop_filter`
26+
how_to_implement: |
27+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880. The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
28+
known_false_positives: |
29+
Planned maintenance, network outages, routing changes, or benign configuration
30+
updates may reduce log volume temporarily. Validate against change management
31+
records and corroborate with device health metrics.
32+
references:
33+
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
34+
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
35+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
36+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
37+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
38+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
39+
- https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
40+
- https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
41+
tags:
42+
analytic_story:
43+
- ArcaneDoor
44+
asset_type: Network
45+
mitre_attack_id:
46+
- T1562
47+
product:
48+
- Splunk Enterprise
49+
- Splunk Enterprise Security
50+
- Splunk Cloud
51+
security_domain: network
52+
cve:
53+
- CVE-2025-20333
54+
- CVE-2025-20362
55+
tests:
56+
- name: True Positive Test
57+
attack_data:
58+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/arcane_door/cisco_asa.log
59+
source: syslog
60+
sourcetype: cisco:asa
Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Cisco ASA - Logging Disabled via CLI
2+
id: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
3+
version: 2
4+
date: '2025-09-25'
5+
author: Bhavin Patel, Micheal Haag, Splunk
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic detects the disabling of logging functionality on a Cisco ASA device
10+
through CLI commands. Adversaries or malicious insiders may attempt to disable logging
11+
to evade detection and hide malicious activity. The detection looks for specific ASA
12+
syslog message IDs (111009, 111010, 111008) associated with command execution,
13+
combined with suspicious commands such as `no logging`, `logging disable`,
14+
`clear logging`, or `no logging host`. Disabling logging on a firewall or security device
15+
is a strong indicator of defense evasion.
16+
data_source:
17+
- Cisco ASA Logs
18+
search: |
19+
`cisco_asa`
20+
| rex "%ASA-[^-]+-\d+-(?<message_id>\d+):"
21+
| search message_id IN (111009,111010,111008)
22+
| rex field=_raw "executed (?:the command )?(?<asa_command>.+)$"
23+
| search asa_command IN ("*no logging*","*logging disable*","*clear logging*","*no logging host*","*no logging trap*")
24+
| stats earliest(_time) as firstTime latest(_time) as lastTime values(user) as user values(action) as action values(asa_command) as commands values(src_ip) as src_ip values(process_name) as process_name by host
25+
| `security_content_ctime(firstTime)`
26+
| `security_content_ctime(lastTime)`
27+
| `cisco_asa___logging_disabled_via_cli_filter`
28+
how_to_implement: |
29+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
30+
known_false_positives: |
31+
Administrators may intentionally disable or modify logging during maintenance,
32+
troubleshooting, or device reconfiguration. These events should be verified
33+
against approved change management activities.
34+
references:
35+
- https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
36+
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
37+
drilldown_searches:
38+
- name: View the detection results for $host$
39+
search: '%original_detection_search% | search host = $host$'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
- name: View risk events for the last 7 days for $host$
43+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: User $user$ from executed commands to disable logging on the Cisco ASA host $host$.
48+
risk_objects:
49+
- field: host
50+
type: system
51+
score: 80
52+
threat_objects:
53+
- field: src_ip
54+
type: ip_address
55+
tags:
56+
analytic_story:
57+
- Suspicious Cisco Adaptive Security Appliance Activity
58+
asset_type: Network
59+
mitre_attack_id:
60+
- T1562
61+
product:
62+
- Splunk Enterprise
63+
- Splunk Enterprise Security
64+
security_domain: network
65+
tests:
66+
- name: True Positive Test
67+
attack_data:
68+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/arcane_door/cisco_asa.log
69+
source: syslog
70+
sourcetype: cisco:asa

detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco Secure Firewall - Intrusion Events by Threat Activity
22
id: b71e57e8-c571-4ff1-ae13-bc4384a9e891
3-
version: 3
4-
date: '2025-08-21'
3+
version: 4
4+
date: '2025-09-25'
55
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -16,6 +16,7 @@ description: |
1616
events that occur in close temporal proximity.
1717
1818
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
19+
* ArcaneDoor
1920
* Static Tundra
2021
* AgentTesla
2122
* Amadey
@@ -81,6 +82,7 @@ rba:
8182
tags:
8283
analytic_story:
8384
- Cisco Secure Firewall Threat Defense Analytics
85+
- ArcaneDoor
8486
asset_type: Network
8587
security_domain: network
8688
mitre_attack_id:

lookups/cisco_snort_ids_to_threat_mapping.csv

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
threat,signature_id,category,message
2+
ArcaneDoor,46897,SERVER-WEBAPP,Cisco Adaptive Security Appliance directory traversal attempt
3+
ArcaneDoor,65340,SERVER-WEBAPP,TRUFFLEHUNTER SFVRT-1055 attack attempt
24
AgentTesla,40238,MALWARE-CNC,Win.Keylogger.AgentTesla variant outbound connection
35
AgentTesla,52246,INDICATOR-COMPROMISE,AgentTesla variant outbound connection attempt
46
AgentTesla,52612,MALWARE-CNC,Win.Trojan.AgentTesla variant outbound connection detected

lookups/cisco_snort_ids_to_threat_mapping.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: cisco_snort_ids_to_threat_mapping
2-
date: 2025-08-21
3-
version: 2
2+
date: 2025-09-24
3+
version: 3
44
id: f08ae6ce-d7a8-423e-a778-be7178a719f9
55
author: Bhavin Patel, Nasreddine Bencherchali, Splunk Threat Research Team
66
lookup_type: csv

lookups/threat_snort_count.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
threat,description,distinct_count_snort_ids
2+
ArcaneDoor,"ArcaneDoor is a state-sponsored cyberespionage campaign targeting perimeter network devices from multiple vendors, with a particular focus on Cisco Secure Firewall ASA/FTD appliances.",2
23
AgentTesla,"AgentTesla is a widely used .NET-based infostealer that exfiltrates credentials, clipboard data, and keystrokes. It often spreads via phishing emails with malicious attachments.",2
34
Amadey,"Amadey is a lightweight malware primarily used as a loader for deploying additional payloads. It collects system information and often works alongside other malware like SmokeLoader.",1
45
AsyncRAT,"AsyncRAT is an open-source Remote Access Trojan (RAT) used for remote control, keylogging, and credential theft. It's commonly used by both amateurs and cybercriminals due to its ease of deployment.",1

lookups/threat_snort_count.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: threat_snort_count
2-
date: 2025-08-21
3-
version: 2
2+
date: 2025-09-24
3+
version: 3
44
id: 48a35e07-ed5f-42f9-a5da-b7f2ab892e3c
55
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
66
lookup_type: csv

0 commit comments

Comments
 (0)