mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
63 lines
1.8 KiB
YAML
63 lines
1.8 KiB
YAML
name: TOR Traffic
|
|
id: ea688274-9c06-4473-b951-e4cb7a5d7a45
|
|
version: 2
|
|
date: '2020-07-22'
|
|
author: David Dorsey, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Network_Traffic
|
|
description: This search looks for network traffic identified as The Onion Router
|
|
(TOR), a benign anonymity network which can be abused for a variety of nefarious
|
|
purposes.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed
|
|
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")`
|
|
| `tor_traffic_filter`'
|
|
how_to_implement: In order to properly run this search, Splunk needs to ingest data
|
|
from firewalls or other network control devices that mediate the traffic allowed
|
|
into an environment. This is necessary so that the search can identify an 'action'
|
|
taken on the traffic of interest. The search requires the Network_Traffic data model
|
|
be populated.
|
|
known_false_positives: None at this time
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Prohibited Traffic Allowed or Protocol Mismatch
|
|
- Ransomware
|
|
- NOBELIUM Group
|
|
- Command and Control
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 9
|
|
- CIS 12
|
|
kill_chain_phases:
|
|
- Command & Control
|
|
mitre_attack_id:
|
|
- T1071
|
|
- T1071.001
|
|
nist:
|
|
- DE.AE
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- All_Traffic.app
|
|
- All_Traffic.action
|
|
- All_Traffic.src_ip
|
|
- All_Traffic.dest_ip
|
|
- All_Traffic.dest_port
|
|
security_domain: network
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context: []
|
|
message: tbd
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|