From a50fe30d9db385e82abfeef09726462a90eebb02 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 22 May 2025 10:17:47 +0200 Subject: [PATCH] update network cim analytics with ftd data --- detections/network/detect_outbound_ldap_traffic.yml | 12 +++++++++--- detections/network/detect_outbound_smb_traffic.yml | 12 +++++++++--- detections/network/internal_horizontal_port_scan.yml | 12 +++++++++--- .../internal_horizontal_port_scan_nmap_top_20.yml | 12 +++++++++--- detections/network/internal_vertical_port_scan.yml | 12 +++++++++--- 5 files changed, 45 insertions(+), 15 deletions(-) diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 72df45a53a..92e1f67908 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -1,7 +1,7 @@ name: Detect Outbound LDAP Traffic id: 5e06e262-d7cd-4216-b2f8-27b437e18458 -version: 7 -date: '2025-05-02' +version: 8 +date: '2025-05-22' author: Bhavin Patel, Johan Bjerke, Splunk status: production type: Hunting @@ -14,6 +14,7 @@ description: The following analytic identifies outbound LDAP traffic to external network compromise. data_source: - Palo Alto Network Traffic +- Cisco Secure Firewall Threat Defense Connection Event search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip @@ -48,8 +49,13 @@ tags: - Splunk Cloud security_domain: network tests: -- name: True Positive Test +- name: Palo Alto True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log sourcetype: pan:traffic source: pan:traffic +- name: Cisco Secure Firewall True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log + source: not_applicable + sourcetype: cisco:sfw:estreamer diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 35e6ae3f12..e80d224295 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -1,7 +1,7 @@ name: Detect Outbound SMB Traffic id: 1bed7774-304a-4e8f-9d72-d80e45ff492b -version: 10 -date: '2025-05-02' +version: 11 +date: '2025-05-22' author: Bhavin Patel, Stuart Hopkins, Patrick Bareiss status: experimental type: TTP @@ -15,6 +15,7 @@ description: The following analytic detects outbound SMB (Server Message Block) full system compromise. data_source: - Zeek Conn +- Cisco Secure Firewall Threat Defense Connection Event search: '| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app values(sourcetype) as sourcetype count from datamodel=Network_Traffic where (All_Traffic.action=allowed @@ -61,8 +62,13 @@ tags: - Splunk Cloud security_domain: network tests: -- name: True Positive Test +- name: Zeek True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log sourcetype: bro:conn:json source: conn.log +- name: Cisco Secure Firewall True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log + source: not_applicable + sourcetype: cisco:sfw:estreamer diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml index 7a41837646..fe138e951b 100644 --- a/detections/network/internal_horizontal_port_scan.yml +++ b/detections/network/internal_horizontal_port_scan.yml @@ -1,12 +1,13 @@ name: Internal Horizontal Port Scan id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-05-22' author: Dean Luxton status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- Cisco Secure Firewall Threat Defense Connection Event description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance @@ -65,8 +66,13 @@ tags: - Splunk Cloud security_domain: network tests: -- name: True Positive Test +- name: AWS CloudWatch True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow +- name: Cisco Secure Firewall True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log + source: not_applicable + sourcetype: cisco:sfw:estreamer diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index bb579e54fc..8d2d4ca756 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,12 +1,13 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 4 -date: '2025-05-02' +version: 5 +date: '2025-05-22' author: Dean Luxton status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- Cisco Secure Firewall Threat Defense Connection Event description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using on of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance @@ -67,8 +68,13 @@ tags: - Splunk Cloud security_domain: network tests: -- name: True Positive Test +- name: AWS CloudWatch True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow +- name: Cisco Secure Firewall True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log + source: not_applicable + sourcetype: cisco:sfw:estreamer diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml index 8709d0c686..bd77f17fcf 100644 --- a/detections/network/internal_vertical_port_scan.yml +++ b/detections/network/internal_vertical_port_scan.yml @@ -1,12 +1,13 @@ name: Internal Vertical Port Scan id: 40d2dc41-9bbf-421a-a34b-8611271a6770 -version: 5 -date: '2025-05-02' +version: 6 +date: '2025-05-22' author: Dean Luxton status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- Cisco Secure Firewall Threat Defense Connection Event description: This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on @@ -65,8 +66,13 @@ tags: - Splunk Cloud security_domain: network tests: -- name: True Positive Test +- name: AWS CloudWatch True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow +- name: Cisco Secure Firewall True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log + source: not_applicable + sourcetype: cisco:sfw:estreamer