Skip to content

Commit e0a335e

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3498 from splunk/snort-correlation-batch
Cisco Secure Firewall Detections - Intrusion Correlation and Activity
2 parents 4bad76b + c085c0c commit e0a335e

5 files changed

+434
-0
lines changed

‎detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Cisco Secure Firewall - High Priority Intrusion Classification
2+
id: ec99bb81-c31b-4837-8c7d-1b32aa70b337
3+
version: 1
4+
date: '2025-04-28'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs.
10+
It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as:
11+
12+
- A Network Trojan was Detected
13+
- Successful Administrator Privilege Gain
14+
- Successful User Privilege Gain
15+
- Attempt to Login By a Default Username and Password
16+
- Known malware command and control traffic
17+
- Known malicious file or file based exploit
18+
- Known client side exploit attempt
19+
- Large Scale Information Leak"
20+
21+
These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
22+
data_source:
23+
- Cisco Secure Firewall Threat Defense Intrusion Event
24+
search: |
25+
`cisco_secure_firewall` EventType=IntrusionEvent
26+
class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak")
27+
| fillnull
28+
| stats count min(_time) as firstTime max(_time) as lastTime
29+
values(signature_id) as signature_id
30+
values(MitreAttackGroups) as MitreAttackGroups
31+
values(InlineResult) as InlineResult
32+
values(InlineResultReason) as InlineResultReason
33+
values(dest_port) as dest_port
34+
values(rule) as rule
35+
values(transport) as transport
36+
values(app) as app
37+
by src_ip, dest_ip, signature, class_desc
38+
| `security_content_ctime(firstTime)`
39+
| `security_content_ctime(lastTime)`
40+
| `cisco_secure_firewall___high_priority_intrusion_classification_filter`
41+
how_to_implement: |
42+
This search requires Cisco Secure Firewall Threat Defense Logs, which
43+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
44+
We strongly recommend that you specify your environment-specific configurations
45+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
46+
with configurations for your Splunk environment. The search also uses a post-filter
47+
macro designed to filter out known false positives.
48+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
49+
The intrusion access policy must also be configured.
50+
known_false_positives: Some intrusion events that are linked to these classifications might be noisy in certain environments. Apply a combination of filters for specific snort IDs and other indicators.
51+
references:
52+
- https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
53+
drilldown_searches:
54+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
55+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
56+
earliest_offset: $info_min_time$
57+
latest_offset: $info_max_time$
58+
- name: View risk events for the last 7 days for - "$dest_ip$"
59+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
60+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
61+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
62+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
63+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
64+
earliest_offset: $info_min_time$
65+
latest_offset: $info_max_time$
66+
rba:
67+
message: A high priority intrusion event with classification ($class_desc$) was detected from $src_ip$ to $dest_ip$, indicating potential suspicious activity.
68+
risk_objects:
69+
- field: dest_ip
70+
type: system
71+
score: 25
72+
threat_objects:
73+
- field: signature
74+
type: signature
75+
- field: src_ip
76+
type: ip_address
77+
tags:
78+
analytic_story:
79+
- Cisco Secure Firewall Threat Defense Analytics
80+
asset_type: Network
81+
security_domain: network
82+
mitre_attack_id:
83+
- T1203
84+
- T1003
85+
- T1071
86+
- T1190
87+
- T1078
88+
product:
89+
- Splunk Enterprise
90+
- Splunk Cloud
91+
- Splunk Enterprise Security
92+
tests:
93+
- name: True Positive Test
94+
attack_data:
95+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events.log
96+
source: not_applicable
97+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___lumma_stealer_activity.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Cisco Secure Firewall - Lumma Stealer Activity
2+
id: 96bce783-c22e-4e48-8cf1-3eb2794c5083
3+
version: 1
4+
date: '2025-04-28'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four of the following Snort signature IDs 64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811 occurs in the span of 15 minutes from the same host.
11+
If confirmed malicious, this behavior is highly indicative of a successful infection of Lumma Stealer.
12+
data_source:
13+
- Cisco Secure Firewall Threat Defense Intrusion Event
14+
search: |
15+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811)
16+
| bin _time span=15m
17+
| fillnull
18+
| stats dc(signature_id) as unique_signature_count
19+
values(signature_id) as signature_id
20+
values(signature) as signature
21+
values(class_desc) as class_desc
22+
values(MitreAttackGroups) as MitreAttackGroups
23+
values(InlineResult) as InlineResult
24+
values(InlineResultReason) as InlineResultReason
25+
values(dest_ip) as dest_ip
26+
values(dest_port) as dest_port
27+
values(rule) as rule
28+
values(transport) as transport
29+
values(app) as app
30+
min(_time) as firstTime
31+
max(_time) as lastTime
32+
by src_ip
33+
| where unique_signature_count >= 3
34+
| `security_content_ctime(firstTime)`
35+
| `security_content_ctime(lastTime)`
36+
| `cisco_secure_firewall___lumma_stealer_activity_filter`
37+
how_to_implement: |
38+
This search requires Cisco Secure Firewall Threat Defense Logs, which
39+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
40+
We strongly recommend that you specify your environment-specific configurations
41+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
42+
with configurations for your Splunk environment. The search also uses a post-filter
43+
macro designed to filter out known false positives.
44+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
45+
The intrusion access policy must also be configured.
46+
known_false_positives: False positives should be very unlikely.
47+
references:
48+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
49+
drilldown_searches:
50+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
51+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
- name: View risk events for the last 7 days for - "$dest_ip$"
55+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
56+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
57+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
58+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
59+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
60+
earliest_offset: $info_min_time$
61+
latest_offset: $info_max_time$
62+
rba:
63+
message: Lumma Stealer Activity on host $dest_ip$ origniating from $src_ip$
64+
risk_objects:
65+
- field: dest_ip
66+
type: system
67+
score: 25
68+
threat_objects:
69+
- field: signature
70+
type: signature
71+
- field: src_ip
72+
type: ip_address
73+
tags:
74+
analytic_story:
75+
- Cisco Secure Firewall Threat Defense Analytics
76+
- Lumma Stealer
77+
asset_type: Network
78+
security_domain: network
79+
mitre_attack_id:
80+
- T1190
81+
- T1210
82+
- T1027
83+
- T1204
84+
product:
85+
- Splunk Enterprise
86+
- Splunk Cloud
87+
- Splunk Enterprise Security
88+
tests:
89+
- name: True Positive Test
90+
attack_data:
91+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
92+
source: not_applicable
93+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Cisco Secure Firewall - Lumma Stealer Download Attempt
2+
id: 66f22f52-fbae-4be7-a263-561dacb63613
3+
version: 1
4+
date: '2025-04-26'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
11+
data_source:
12+
- Cisco Secure Firewall Threat Defense Intrusion Event
13+
search: |
14+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64810, 64811)
15+
| fillnull
16+
| stats min(_time) as firstTime max(_time) as lastTime
17+
by src_ip dest_ip dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
18+
| `security_content_ctime(firstTime)`
19+
| `security_content_ctime(lastTime)`
20+
| `cisco_secure_firewall___lumma_stealer_download_attempt_filter`
21+
how_to_implement: |
22+
This search requires Cisco Secure Firewall Threat Defense Logs, which
23+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
24+
We strongly recommend that you specify your environment-specific configurations
25+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
26+
with configurations for your Splunk environment. The search also uses a post-filter
27+
macro designed to filter out known false positives.
28+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
29+
The intrusion access policy must also be configured.
30+
known_false_positives: False positives should be unlikely.
31+
references:
32+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
33+
drilldown_searches:
34+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
35+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
- name: View risk events for the last 7 days for - "$dest_ip$"
39+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
40+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
41+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
42+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
43+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: Lumma Stealer Download Attempt detected on host $dest_ip$ origniating from $src_ip$
48+
risk_objects:
49+
- field: dest_ip
50+
type: system
51+
score: 25
52+
threat_objects:
53+
- field: signature
54+
type: signature
55+
- field: src_ip
56+
type: ip_address
57+
tags:
58+
analytic_story:
59+
- Cisco Secure Firewall Threat Defense Analytics
60+
- Lumma Stealer
61+
asset_type: Network
62+
security_domain: network
63+
mitre_attack_id:
64+
- T1041
65+
- T1573.002
66+
product:
67+
- Splunk Enterprise
68+
- Splunk Cloud
69+
- Splunk Enterprise Security
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
74+
source: not_applicable
75+
sourcetype: cisco:sfw:estreamer

‎detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt
2+
id: 66f22f52-fbae-4be7-a263-561dacb63612
3+
version: 1
4+
date: '2025-04-26'
5+
author: Nasreddine Bencherchali, Splunk, Talos NTDR
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events.
10+
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
11+
data_source:
12+
- Cisco Secure Firewall Threat Defense Intrusion Event
13+
search: |
14+
`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709)
15+
| fillnull
16+
| stats min(_time) as firstTime max(_time) as lastTime
17+
by src_ip dest_ip dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
18+
| `security_content_ctime(firstTime)`
19+
| `security_content_ctime(lastTime)`
20+
| `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt_filter`
21+
how_to_implement: |
22+
This search requires Cisco Secure Firewall Threat Defense Logs, which
23+
includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
24+
We strongly recommend that you specify your environment-specific configurations
25+
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
26+
with configurations for your Splunk environment. The search also uses a post-filter
27+
macro designed to filter out known false positives.
28+
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
29+
The intrusion access policy must also be configured.
30+
known_false_positives: False positives should be unlikely.
31+
references:
32+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
33+
drilldown_searches:
34+
- name: View the detection results for - "$dest_ip$" and "$src_ip$"
35+
search: '%original_detection_search% | search dest_ip = "$dest_ip$" and src_ip = "$src_ip$"'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
- name: View risk events for the last 7 days for - "$dest_ip$"
39+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") starthoursago=168 | stats count min(_time)
40+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
41+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
42+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
43+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: Lumma Stealer Outbound Connection Attempt detected on host $dest_ip$ origniating from $src_ip$
48+
risk_objects:
49+
- field: dest_ip
50+
type: system
51+
score: 25
52+
threat_objects:
53+
- field: signature
54+
type: signature
55+
- field: src_ip
56+
type: ip_address
57+
tags:
58+
analytic_story:
59+
- Cisco Secure Firewall Threat Defense Analytics
60+
- Lumma Stealer
61+
asset_type: Network
62+
security_domain: network
63+
mitre_attack_id:
64+
- T1041
65+
- T1573.002
66+
product:
67+
- Splunk Enterprise
68+
- Splunk Cloud
69+
- Splunk Enterprise Security
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events.log
74+
source: not_applicable
75+
sourcetype: cisco:sfw:estreamer

0 commit comments

Comments
 (0)