mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
update network cim analytics with ftd data
This commit is contained in:
Nasreddine Bencherchali
@@ -1,7 +1,7 @@
|
||||
name: Detect Outbound LDAP Traffic
|
||||
id: 5e06e262-d7cd-4216-b2f8-27b437e18458
|
||||
version: 7
|
||||
date: '2025-05-02'
|
||||
version: 8
|
||||
date: '2025-05-22'
|
||||
author: Bhavin Patel, Johan Bjerke, Splunk
|
||||
status: production
|
||||
type: Hunting
|
||||
@@ -14,6 +14,7 @@ description: The following analytic identifies outbound LDAP traffic to external
|
||||
network compromise.
|
||||
data_source:
|
||||
- Palo Alto Network Traffic
|
||||
- Cisco Secure Firewall Threat Defense Connection Event
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic
|
||||
where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip
|
||||
@@ -48,8 +49,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
- name: Palo Alto True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
|
||||
sourcetype: pan:traffic
|
||||
source: pan:traffic
|
||||
- name: Cisco Secure Firewall True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
|
||||
source: not_applicable
|
||||
sourcetype: cisco:sfw:estreamer
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Detect Outbound SMB Traffic
|
||||
id: 1bed7774-304a-4e8f-9d72-d80e45ff492b
|
||||
version: 10
|
||||
date: '2025-05-02'
|
||||
version: 11
|
||||
date: '2025-05-22'
|
||||
author: Bhavin Patel, Stuart Hopkins, Patrick Bareiss
|
||||
status: experimental
|
||||
type: TTP
|
||||
@@ -15,6 +15,7 @@ description: The following analytic detects outbound SMB (Server Message Block)
|
||||
full system compromise.
|
||||
data_source:
|
||||
- Zeek Conn
|
||||
- Cisco Secure Firewall Threat Defense Connection Event
|
||||
search: '| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time)
|
||||
as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app
|
||||
values(sourcetype) as sourcetype count from datamodel=Network_Traffic where (All_Traffic.action=allowed
|
||||
@@ -61,8 +62,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
- name: Zeek True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log
|
||||
sourcetype: bro:conn:json
|
||||
source: conn.log
|
||||
- name: Cisco Secure Firewall True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
|
||||
source: not_applicable
|
||||
sourcetype: cisco:sfw:estreamer
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
name: Internal Horizontal Port Scan
|
||||
id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1
|
||||
version: 6
|
||||
date: '2025-05-02'
|
||||
version: 7
|
||||
date: '2025-05-22'
|
||||
author: Dean Luxton
|
||||
status: production
|
||||
type: TTP
|
||||
data_source:
|
||||
- AWS CloudWatchLogs VPCflow
|
||||
- Cisco Secure Firewall Threat Defense Connection Event
|
||||
description: This analytic identifies instances where an internal host has attempted
|
||||
to communicate with 250 or more destination IP addresses using the same port and
|
||||
protocol. Horizontal port scans from internal hosts can indicate reconnaissance
|
||||
@@ -65,8 +66,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
- name: AWS CloudWatch True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
|
||||
source: aws:cloudwatchlogs:vpcflow
|
||||
sourcetype: aws:cloudwatchlogs:vpcflow
|
||||
- name: Cisco Secure Firewall True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
|
||||
source: not_applicable
|
||||
sourcetype: cisco:sfw:estreamer
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
name: Internal Horizontal Port Scan NMAP Top 20
|
||||
id: 3141a041-4f57-4277-9faa-9305ca1f8e5b
|
||||
version: 4
|
||||
date: '2025-05-02'
|
||||
version: 5
|
||||
date: '2025-05-22'
|
||||
author: Dean Luxton
|
||||
status: production
|
||||
type: TTP
|
||||
data_source:
|
||||
- AWS CloudWatchLogs VPCflow
|
||||
- Cisco Secure Firewall Threat Defense Connection Event
|
||||
description: This analytic identifies instances where an internal host has attempted
|
||||
to communicate with 250 or more destination IP addresses using on of the NMAP top
|
||||
20 ports. Horizontal port scans from internal hosts can indicate reconnaissance
|
||||
@@ -67,8 +68,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
- name: AWS CloudWatch True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
|
||||
source: aws:cloudwatchlogs:vpcflow
|
||||
sourcetype: aws:cloudwatchlogs:vpcflow
|
||||
- name: Cisco Secure Firewall True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
|
||||
source: not_applicable
|
||||
sourcetype: cisco:sfw:estreamer
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
name: Internal Vertical Port Scan
|
||||
id: 40d2dc41-9bbf-421a-a34b-8611271a6770
|
||||
version: 5
|
||||
date: '2025-05-02'
|
||||
version: 6
|
||||
date: '2025-05-22'
|
||||
author: Dean Luxton
|
||||
status: production
|
||||
type: TTP
|
||||
data_source:
|
||||
- AWS CloudWatchLogs VPCflow
|
||||
- Cisco Secure Firewall Threat Defense Connection Event
|
||||
description: This analytic detects instances where an internal host attempts to communicate
|
||||
with over 500 ports on a single destination IP address. It includes filtering criteria
|
||||
to exclude applications performing scans over ephemeral port ranges, focusing on
|
||||
@@ -65,8 +66,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
- name: AWS CloudWatch True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log
|
||||
source: aws:cloudwatchlogs:vpcflow
|
||||
sourcetype: aws:cloudwatchlogs:vpcflow
|
||||
- name: Cisco Secure Firewall True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
|
||||
source: not_applicable
|
||||
sourcetype: cisco:sfw:estreamer
|
||||
|
||||
Reference in New Issue
Block a user