Skip to content

Commit b407d96

Browse files
committed
updating detection yamls
1 parent 45134af commit b407d96

File tree

6 files changed

+123
-23
lines changed

6 files changed

+123
-23
lines changed
Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Cisco Secure Access Firewall
2+
id: 5dc07487-f834-4850-b6a7-4cc09e56549b
3+
version: 1
4+
date: '2026-02-25'
5+
author: Bhavin Patel, Splunk
6+
description: Captures firewall connection events from Cisco Secure Access including user identity, source and destination metadata, protocol details, and session statistics. Enables analysis of network traffic patterns, access policy enforcement, brute force attempts, and anomalous connection behavior across cloud-managed network access infrastructure.
7+
source: cisco_secure_access:firewall
8+
sourcetype: cisco:cloud_security:firewall
9+
supported_TA:
10+
- name: Cisco Secure Access Add-on for Splunk
11+
url: https://splunkbase.splunk.com/app/7569
12+
version: 1.0.48
13+
fields:
14+
- _time
15+
- action
16+
- app
17+
- bytes_in
18+
- bytes_out
19+
- datacenter
20+
- dest
21+
- dest_ip
22+
- dest_port
23+
- direction
24+
- duration
25+
- dvc
26+
- identity
27+
- identity_type
28+
- packets_in
29+
- packets_out
30+
- protocol
31+
- protocol_version
32+
- rule_id
33+
- session_id
34+
- src
35+
- src_ip
36+
- src_port
37+
- transport
38+
- tunnel_id
39+
- user
40+
- vendor_product
41+
output_fields:
42+
- dest_ip
43+
- dest_port
44+
- src_ip
45+
- user
46+
- action
47+
example_log: '"2026-03-05 17:29:39","[1360486514]","Joe Kehoe (joe.kehoe@d1.pseudoco.org)","AD
48+
Users","C2S","6","0","","","10.10.3.220","3389","prod_aws_us-west-2_1_0","1482901","ALLOW","","[]","1772731753","1772731779","93","82","20847","46067","2ef4dc5a90e31b4e2f7d21ec8f863accda6ad5db2d6feeff301ca05d298fcbdb-7-1772731753-45877","","aws-us-west-2","","178937","true","1145001","[]","2","[]","[]","8176184","","","f0b0ce3d69aeedfe"'

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,38 @@
11
name: Detect Use of cmd exe to Launch Script Interpreters
22
id: b89919ed-fe5f-492c-b139-95dbb162039e
3-
version: 13
4-
date: '2026-03-10'
3+
version: 14
4+
date: '2026-03-24'
55
author: Bhavin Patel, Mauricio Velazco, Splunk
66
status: production
77
type: TTP
8-
description: The following analytic detects the execution of cscript.exe or wscript.exe processes initiated by cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes within the Endpoint data model. This activity is significant as it may indicate script-based attacks or administrative actions that could be leveraged for malicious purposes. If confirmed malicious, this behavior could allow attackers to execute scripts, potentially leading to code execution, privilege escalation, or persistence within the environment.
8+
description: The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity. The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior. These enhancements transform the analytic from a broad pattern-based detection into a more behavior-driven approach, increasing its effectiveness in identifying malicious script interpreter usage that could indicate initial access, persistence, or lateral movement.
99
data_source:
1010
- Sysmon EventID 1
1111
- Windows Event Log Security 4688
1212
- CrowdStrike ProcessRollup2
1313
search: |-
14-
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
15-
WHERE Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe
16-
OR
17-
Processes.process_name =wscript.exe)
18-
BY Processes.action Processes.dest Processes.original_file_name
19-
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
20-
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
21-
Processes.process Processes.process_exec Processes.process_guid
22-
Processes.process_hash Processes.process_id Processes.process_integrity_level
23-
Processes.process_name Processes.process_path Processes.user
24-
Processes.user_id Processes.vendor_product
14+
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
15+
FROM datamodel=Endpoint.Processes
16+
WHERE Processes.parent_process_name="cmd.exe"
17+
AND (Processes.process_name="cscript.exe" OR Processes.process_name="wscript.exe")
18+
BY Processes.action Processes.dest Processes.original_file_name
19+
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
20+
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
21+
Processes.process Processes.process_exec Processes.process_guid
22+
Processes.process_hash Processes.process_id Processes.process_integrity_level
23+
Processes.process_name Processes.process_path Processes.user
24+
Processes.user_id Processes.vendor_product
2525
| `drop_dm_object_name("Processes")`
26+
27+
| where like(process, "%\\Users\\%")
28+
OR like(process, "%\\AppData\\%")
29+
OR like(process, "%\\Temp\\%")
30+
31+
| where NOT like(process, "%\\Windows\\System32\\%")
32+
| where NOT like(process, "%\\Program Files\\%")
33+
34+
| where NOT match(user, ".*\\$$")
35+
2636
| `security_content_ctime(firstTime)`
2737
| `security_content_ctime(lastTime)`
2838
| `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`
@@ -41,12 +51,14 @@ drilldown_searches:
4151
earliest_offset: $info_min_time$
4252
latest_offset: $info_max_time$
4353
rba:
44-
message: cmd.exe launching script interpreters $process_name$ on $dest$
54+
message: cmd.exe launching script interpreters [$process_name$] with commandline [$process$] on [$dest$]
4555
risk_objects:
4656
- field: dest
4757
type: system
4858
score: 50
49-
threat_objects: []
59+
threat_objects:
60+
- field: process
61+
type: process
5062
tags:
5163
analytic_story:
5264
- Emotet Malware DHS Report TA18-201A

detections/network/detect_large_icmp_traffic.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,17 @@
11
name: Detect Large ICMP Traffic
22
id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8
3-
version: 4
4-
date: '2026-03-10'
3+
version: 5
4+
date: '2026-03-25'
55
author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk
66
status: production
77
type: TTP
88
description: The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities. If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
99
data_source:
1010
- Palo Alto Network Traffic
11+
- Cisco Secure Access Firewall
1112
search: |-
1213
| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) as action
13-
from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
14+
from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND NOT All_Traffic.dest IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
1415
by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.protocol, All_Traffic.bytes, All_Traffic.app, All_Traffic.bytes_in, All_Traffic.bytes_out, All_Traffic.dest_port, All_Traffic.dvc, All_Traffic.protocol_version,
1516
All_Traffic.src_port, All_Traffic.user, All_Traffic.vendor_product
1617
| `drop_dm_object_name("All_Traffic")`
@@ -59,3 +60,8 @@ tests:
5960
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log
6061
sourcetype: pan:traffic
6162
source: pan:traffic
63+
- name: True Positive Test - Cisco Secure Access Firewall
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/firewall/large_icmp.log
66+
source: not_applicable
67+
sourcetype: cisco:secure_access:firewall

detections/network/detect_outbound_ldap_traffic.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Outbound LDAP Traffic
22
id: 5e06e262-d7cd-4216-b2f8-27b437e18458
3-
version: 10
4-
date: '2026-02-25'
3+
version: 11
4+
date: '2026-03-25'
55
author: Bhavin Patel, Johan Bjerke, Splunk
66
status: production
77
type: Hunting
@@ -61,3 +61,8 @@ tests:
6161
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
6262
source: not_applicable
6363
sourcetype: cisco:sfw:estreamer
64+
- name: Cisco Secure Access Firewall True Positive Test
65+
attack_data:
66+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/firewall/ldap.log
67+
source: not_applicable
68+
sourcetype: cisco:secure_access:firewall

detections/network/windows_remote_desktop_network_bruteforce_attempt.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Remote Desktop Network Bruteforce Attempt
22
id: 908bf0d5-0983-4afd-b6a4-e9eb5d361a7d
3-
version: 7
4-
date: '2026-03-10'
3+
version: 8
4+
date: '2026-03-29'
55
author: Jose Hernandez, Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -69,3 +69,8 @@ tests:
6969
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/rdp_brute_sysmon/sysmon.log
7070
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
7171
sourcetype: XmlWinEventLog
72+
- name: True Positive Test - Cisco Secure Access Firewall
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/firewall/rdp_brute_force.log
75+
source: not_applicable
76+
sourcetype: cisco:cloud_security:firewall
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Cisco Secure Access Analytics
2+
id: 5ba62cae-0757-497c-9226-771e3bf37eb8
3+
version: 1
4+
date: '2026-02-25'
5+
author: Bhavin Patel, Splunk
6+
status: production
7+
description: |
8+
This analytic story provides a suite of detections built to analyze network and access logs from Cisco Secure Access.
9+
The included analytics focus on uncovering suspicious and potentially malicious behavior such as unauthorized access attempts, anomalous authentication patterns, policy violations, and indicators of compromised credentials.
10+
These detections help security teams identify threats that may bypass traditional perimeter defenses, offering deeper insight into user access behavior, device posture anomalies, and adversary abuse of legitimate access pathways.
11+
narrative: |
12+
Cisco Secure Access is a cloud-delivered security service edge (SSE) solution that provides secure connectivity and access control for users, devices, and applications regardless of location.
13+
It combines zero trust network access (ZTNA), secure web gateway (SWG), cloud access security broker (CASB), and firewall-as-a-service capabilities into a unified platform.
14+
This analytic story leverages the rich telemetry generated by Cisco Secure Access to detect behaviors commonly associated with advanced threats and adversary techniques across multiple ATT&CK tactics, including Initial Access, Credential Access, Lateral Movement, and Exfiltration.
15+
references:
16+
- https://www.cisco.com/site/us/en/products/security/secure-access/index.html
17+
tags:
18+
category:
19+
- Adversary Tactics
20+
product:
21+
- Splunk Enterprise
22+
- Splunk Enterprise Security
23+
- Splunk Cloud
24+
usecase: Advanced Threat Detection

0 commit comments

Comments
 (0)