You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Captures firewall connection events from Cisco Secure Access including user identity, source and destination metadata, protocol details, and session statistics. Enables analysis of network traffic patterns, access policy enforcement, brute force attempts, and anomalous connection behavior across cloud-managed network access infrastructure.
Copy file name to clipboardExpand all lines: detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+28-16Lines changed: 28 additions & 16 deletions
Original file line number
Diff line number
Diff line change
@@ -1,28 +1,38 @@
1
1
name: Detect Use of cmd exe to Launch Script Interpreters
2
2
id: b89919ed-fe5f-492c-b139-95dbb162039e
3
-
version: 13
4
-
date: '2026-03-10'
3
+
version: 14
4
+
date: '2026-03-24'
5
5
author: Bhavin Patel, Mauricio Velazco, Splunk
6
6
status: production
7
7
type: TTP
8
-
description: The following analytic detects the execution of cscript.exe or wscript.exe processes initiated by cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes within the Endpoint data model. This activity is significant as it may indicate script-based attacks or administrative actions that could be leveraged for malicious purposes. If confirmed malicious, this behavior could allow attackers to execute scripts, potentially leading to code execution, privilege escalation, or persistence within the environment.
8
+
description: The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity. The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior. These enhancements transform the analytic from a broad pattern-based detection into a more behavior-driven approach, increasing its effectiveness in identifying malicious script interpreter usage that could indicate initial access, persistence, or lateral movement.
9
9
data_source:
10
10
- Sysmon EventID 1
11
11
- Windows Event Log Security 4688
12
12
- CrowdStrike ProcessRollup2
13
13
search: |-
14
-
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
15
-
WHERE Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe
16
-
OR
17
-
Processes.process_name =wscript.exe)
18
-
BY Processes.action Processes.dest Processes.original_file_name
Copy file name to clipboardExpand all lines: detections/network/detect_large_icmp_traffic.yml
+9-3Lines changed: 9 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,17 @@
1
1
name: Detect Large ICMP Traffic
2
2
id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8
3
-
version: 4
4
-
date: '2026-03-10'
3
+
version: 5
4
+
date: '2026-03-25'
5
5
author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk
6
6
status: production
7
7
type: TTP
8
8
description: The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities. If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
9
9
data_source:
10
10
- Palo Alto Network Traffic
11
+
- Cisco Secure Access Firewall
11
12
search: |-
12
13
| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) as action
13
-
from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
14
+
from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND NOT All_Traffic.dest IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
This analytic story provides a suite of detections built to analyze network and access logs from Cisco Secure Access.
9
+
The included analytics focus on uncovering suspicious and potentially malicious behavior such as unauthorized access attempts, anomalous authentication patterns, policy violations, and indicators of compromised credentials.
10
+
These detections help security teams identify threats that may bypass traditional perimeter defenses, offering deeper insight into user access behavior, device posture anomalies, and adversary abuse of legitimate access pathways.
11
+
narrative: |
12
+
Cisco Secure Access is a cloud-delivered security service edge (SSE) solution that provides secure connectivity and access control for users, devices, and applications regardless of location.
13
+
It combines zero trust network access (ZTNA), secure web gateway (SWG), cloud access security broker (CASB), and firewall-as-a-service capabilities into a unified platform.
14
+
This analytic story leverages the rich telemetry generated by Cisco Secure Access to detect behaviors commonly associated with advanced threats and adversary techniques across multiple ATT&CK tactics, including Initial Access, Credential Access, Lateral Movement, and Exfiltration.
0 commit comments