From 52b666b7c9d94f3d4f03eea51056f4e07a52bdad Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Oct 2023 11:10:25 -0600
Subject: [PATCH 1/4] Cisco IOS XE Vulnerability CVE-2023-20198

---
 .../web/cisco_ios_xe_implant_access.yml       | 58 +++++++++++++++++++
 ...anagement_user_interface_vulnerability.yml | 18 ++++++
 2 files changed, 76 insertions(+)
 create mode 100644 detections/web/cisco_ios_xe_implant_access.yml
 create mode 100644 stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml

diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml
new file mode 100644
index 0000000000..b544192873
--- /dev/null
+++ b/detections/web/cisco_ios_xe_implant_access.yml
@@ -0,0 +1,58 @@
+name: Cisco IOS XE Implant Access
+id: 07c36cda-6567-43c3-bc1a-89dff61e2cd9
+version: 1
+date: '2023-10-17'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies potential exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198). Successful exploitation allows an attacker to create an account on the affected device with privilege level 15 access, granting them full control of the compromised device. The detection is based on the observation of suspicious account creation and subsequent actions, including the deployment of an implant consisting of a configuration file. The implant is saved under the file path //usr//binos//conf//nginx-conf//cisco_service.conf and is not persistent, meaning a device reboot will remove it, but the newly created local user accounts remain active even after system reboots. The new user accounts have level 15 privileges, meaning they have full administrator access to the device. This privileged access to the devices and subsequent creation of new users is tracked as CVE-2023-20198.
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/webui/logoutconfirm.html?logon_hash=*") Web.http_method=POST Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`| `cisco_ios_xe_implant_access_filter`'
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto. 
+known_false_positives: False positives may be present, restrict to Cisco IOS XE devices or perimeter appliances. Modify the analytic as needed based on hunting for successful exploitation of CVE-2023-20198.
+references:
+- https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
+- https://github.com/vulncheck-oss/cisco-ios-xe-implant-scanner
+tags:
+  cve:
+  - CVE-2023-20198
+  analytic_story:
+  - Cisco IOS XE Software Web Management User Interface vulnerability
+  asset_type: Network
+  atomic_guid:
+  - UPDATE atomic_guid
+  confidence: 90
+  impact: 90
+  message: Possible exploitation of CVE-2023-20198 against $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 81
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198.log
+    source: suricata
+    sourcetype: suricata
diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
new file mode 100644
index 0000000000..bca5355bae
--- /dev/null
+++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
@@ -0,0 +1,18 @@
+name: Cisco IOS XE Software Web Management User Interface vulnerability
+id: b5394b6a-b774-4bb6-a2bc-98f98cf7be88
+version: 1
+date: '2023-10-17'
+author: Michael Haag, Splunk
+description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity.
+narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username “cisco_tac_admin” from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name “cisco_support” from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (“cisco_service.conf”). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed.
+references:
+- https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
+tags:
+  analytic_story: Cisco IOS XE Software Web Management User Interface vulnerability
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 0c1e54f925fcbe7bd583aa75a9f2c0caec09986c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Oct 2023 11:17:03 -0600
Subject: [PATCH 2/4] Update
 cisco_ios_xe_software_web_management_user_interface_vulnerability.yml

---
 ..._xe_software_web_management_user_interface_vulnerability.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
index bca5355bae..6e014d9d42 100644
--- a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
+++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
@@ -4,7 +4,7 @@ version: 1
 date: '2023-10-17'
 author: Michael Haag, Splunk
 description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity.
-narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username “cisco_tac_admin” from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name “cisco_support” from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (“cisco_service.conf”). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed.
+narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username cisco_tac_admin from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name cisco_support from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (cisco_service.conf). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed.
 references:
 - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
 tags:

From 4855e9d357aee0b45e9a990e2eb407ea96605395 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Oct 2023 11:23:14 -0600
Subject: [PATCH 3/4] fix

---
 detections/web/cisco_ios_xe_implant_access.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml
index b544192873..d9aa7cac7f 100644
--- a/detections/web/cisco_ios_xe_implant_access.yml
+++ b/detections/web/cisco_ios_xe_implant_access.yml
@@ -25,8 +25,7 @@ tags:
   analytic_story:
   - Cisco IOS XE Software Web Management User Interface vulnerability
   asset_type: Network
-  atomic_guid:
-  - UPDATE atomic_guid
+  atomic_guid: []
   confidence: 90
   impact: 90
   message: Possible exploitation of CVE-2023-20198 against $dest$.

From 64775a0bf6046753a7372bdaced1afaa37e264ce Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Oct 2023 11:24:13 -0600
Subject: [PATCH 4/4] Update cisco_ios_xe_implant_access.yml

---
 detections/web/cisco_ios_xe_implant_access.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml
index b544192873..bcab0de85c 100644
--- a/detections/web/cisco_ios_xe_implant_access.yml
+++ b/detections/web/cisco_ios_xe_implant_access.yml
@@ -29,7 +29,7 @@ tags:
   - UPDATE atomic_guid
   confidence: 90
   impact: 90
-  message: Possible exploitation of CVE-2023-20198 against $dest$.
+  message: Possible exploitation of CVE-2023-20198 against $dest$ by $src$.
   mitre_attack_id:
   - T1190
   observable:
@@ -37,6 +37,10 @@ tags:
     type: Hostname
     role:
     - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security