mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
86 lines
4.0 KiB
JSON
86 lines
4.0 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest_ip, src_ip",
|
|
"rule_description": "This search looks for network traffic on common ports where the underlying protocol does not match the port being used. For example, this search should identify cases where protocols other than HTTP are running on port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications in traffic that is typically allowed and not well inspected.",
|
|
"rule_title": "Protocol / Port Mismatch from $src_ip$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "src_ip",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest_ip, dest_port",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-04-18",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Network_Traffic"
|
|
],
|
|
"data_source": [
|
|
"Network Communications"
|
|
],
|
|
"providing_technologies": [
|
|
"Palo Alto Firewall",
|
|
"Bro",
|
|
"Splunk Stream"
|
|
]
|
|
},
|
|
"eli5": "This search looks for instances in which the protocol observed is not consistent with the port and transport protocol typically used for that protocol. For example, looking for network traffic other than HTTP running over TCP port 80. Such behavior could indicate a misconfiguration or a custom command and control protocol that has been designed to look like ordinary web traffic. The search will also identify if HTTP traffic is observed running on unexpected ports. This can be common in many environments.",
|
|
"how_to_implement": "Running this search properly requires a technology that can inspect network traffic and identify common protocols. Technologies such as Bro and Palo Alto Networks firewalls are two examples that will identify protocols via inspection, and not just assume a specific protocol based on the transport protocol and ports.",
|
|
"known_false_positives": "None identified",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 9",
|
|
"CIS 12"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Command and Control"
|
|
],
|
|
"mitre_attack": [
|
|
"Command and Control",
|
|
"Commonly Used Port"
|
|
],
|
|
"nist": [
|
|
"DE.AE",
|
|
"PR.AC"
|
|
]
|
|
},
|
|
"modification_date": "2017-09-11",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.app=dns NOT All_Traffic.dest_port=53) OR ((All_Traffic.app=web-browsing OR All_Traffic.app=http) NOT (All_Traffic.dest_port=80 OR All_Traffic.dest_port=8080 OR All_Traffic.dest_port=8000)) OR (All_Traffic.app=ssl NOT (All_Traffic.dest_port=443 OR All_Traffic.dest_port=8443)) OR (All_Traffic.app=smtp NOT All_Traffic.dest_port=25) by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.dest_port |`ctime(firstTime)` | `ctime(lastTime)` | `drop_dm_object_name(\"All_Traffic\")`",
|
|
"search_description": "This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected.",
|
|
"search_id": "54dc1265-2f74-4b6d-b30d-49eb506a31b3",
|
|
"search_name": "Protocol or Port Mismatch",
|
|
"search_type": "detection",
|
|
"security_domain": "network",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|