From 149b36260263fe9c56be9cb2fd5385d31f032a11 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Jul 2025 09:09:17 -0700 Subject: [PATCH 1/3] updating spl --- ...sco_nvm___installation_of_typosquatted_python_package.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 52f30f90f2..f9884d15ef 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -34,14 +34,13 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport package_name comment package_official_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table + | table firstTime lastTime src dest_hostname dest dest_port transport package_name comment package_official_url parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list - src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___installation_of_typosquatted_python_package_filter` how_to_implement: | This search requires Network Visibility Module logs, which includes the flow data sourcetype. From 9bc9e5f6499e742f60ebea2e89726b452c648798 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Jul 2025 09:15:47 -0700 Subject: [PATCH 2/3] adding parent process name --- ...__suspicious_file_download_via_headless_browser.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index ac7c7c6304..c3898b7a5f 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -13,7 +13,7 @@ description: | data_source: - Cisco Network Visibility Module Flow Data search: | - `cisco_network_visibility_module_flowdata` + `cisco_network_visibility_module_flowdata` ``` Usually the initiator of the connection is the child process, meaning the parent will contain the suspicious command.``` @@ -40,7 +40,7 @@ search: | | rex field=parent_process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | rex field=process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | eval direct_ip_match=if(dest == extracted_ip_child, 1, if(dest == extracted_ip_parent, 1, 0)) - + | where ( dest_hostname IN ( "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", @@ -53,7 +53,7 @@ search: | ) OR direct_ip_match = 1 ) - + | stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_arguments) as parent_process_arguments values(process_arguments) as process_arguments @@ -64,11 +64,11 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table - parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash + parent_process_integrity_level parent_process_path parent_process_name parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime From 2d930a03c78c5ebaf99eb0862d1d0b427fb6c1aa Mon Sep 17 00:00:00 2001 From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Date: Wed, 9 Jul 2025 07:00:28 +0000 Subject: [PATCH 3/3] Updated TAs --- contentctl.yml | 13 ++++++++----- data_sources/okta.yml | 4 ++-- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index d7ed077e3c..6b1f9b54b2 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -38,9 +38,9 @@ apps: - uid: 6553 title: Splunk Add-on for Okta Identity Cloud appid: Splunk_TA_okta_identity_cloud - version: 3.0.0 + version: 4.0.0 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_300.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_400.tgz - uid: 7404 title: Cisco Security Cloud appid: CiscoSecurityCloud @@ -229,8 +229,11 @@ apps: title: Cisco NVM Add-on for Splunk appid: TA-Cisco-NVM version: 4.0.7 - description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows IT administrators to analyze and correlate user and endpoint behavior in Splunk Enterprise. - This Add-on provides configuration and collection of data from the Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. - This module collects additional context such as user, device, application, location and destination for flows both on and off premise. + description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows + IT administrators to analyze and correlate user and endpoint behavior in Splunk + Enterprise. This Add-on provides configuration and collection of data from the + Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. This module + collects additional context such as user, device, application, location and destination + for flows both on and off premise. hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-endpoint-security-analytics-cesa-add-on-for-splunk_407.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 64071d80af..2fbd630605 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,8 +16,8 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 3.0.0 + version: 4.0.0 output_fields: - dest - src -- user \ No newline at end of file +- user