mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
name: TOR Traffic
|
|
id: ea688274-9c06-4473-b951-e4cb7a5d7a45
|
|
version: 4
|
|
date: '2024-05-29'
|
|
author: David Dorsey, Bhavin Patel, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic identifies allowed network traffic to The Onion
|
|
Router (TOR), an anonymity network often exploited for malicious activities. It
|
|
leverages data from Next Generation Firewalls, using the Network_Traffic data model
|
|
to detect traffic where the application is TOR and the action is allowed. This activity
|
|
is significant as TOR can be used to bypass conventional monitoring, facilitating
|
|
hacking, data breaches, and illicit content dissemination. If confirmed malicious,
|
|
this could lead to unauthorized access, data exfiltration, and severe compliance
|
|
violations, compromising the integrity and security of the network.
|
|
data_source:
|
|
- Palo Alto Network Traffic
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed
|
|
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")`
|
|
| `tor_traffic_filter`'
|
|
how_to_implement: In order to properly run this search, Splunk needs to ingest data
|
|
from Next Generation Firewalls like Palo Alto Networks Firewalls or other network
|
|
control devices that mediate the traffic allowed into an environment. This is necessary
|
|
so that the search can identify an 'action' taken on the traffic of interest. The
|
|
search requires the Network_Traffic data model to be populated.
|
|
known_false_positives: None at this time
|
|
references:
|
|
- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
|
|
- https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.
|
|
tags:
|
|
analytic_story:
|
|
- Prohibited Traffic Allowed or Protocol Mismatch
|
|
- Ransomware
|
|
- NOBELIUM Group
|
|
- Command And Control
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
impact: 100
|
|
message: Suspicious network traffic allowed using TOR has been detected from $src_ip$
|
|
to $dest_ip$
|
|
mitre_attack_id:
|
|
- T1090
|
|
- T1090.003
|
|
observable:
|
|
- name: src_ip
|
|
type: IP Address
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- All_Traffic.app
|
|
- All_Traffic.action
|
|
- All_Traffic.src_ip
|
|
- All_Traffic.dest_ip
|
|
- All_Traffic.dest_port
|
|
risk_score: 80
|
|
security_domain: network
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log
|
|
source: pan_tor_allowed
|
|
sourcetype: pan:traffic
|