mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
57 lines
3.0 KiB
YAML
57 lines
3.0 KiB
YAML
name: TOR Traffic
|
|
id: ea688274-9c06-4473-b951-e4cb7a5d7a45
|
|
version: 3
|
|
date: '2023-09-20'
|
|
author: David Dorsey, Bhavin Patel, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic looks for allowed network traffic to The Onion Router(TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. Detecting Tor traffic is paramount for upholding network security and mitigating potential threats. Tor's capacity to provide users with anonymity has been exploited by cybercriminals for activities like hacking, data breaches, and illicit content dissemination. Additionally, organizations must monitor Tor usage within their networks to ensure compliance with policies and regulations, as it can bypass conventional monitoring and filtering measures. Lastly, the ability to identify Tor traffic empowers security teams to promptly investigate and address potential security incidents, fortifying the protection of sensitive data and preserving the integrity of the network environment.
|
|
data_source: []
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed
|
|
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")`
|
|
| `tor_traffic_filter`'
|
|
how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated.
|
|
known_false_positives: None at this time
|
|
references:
|
|
- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
|
|
- https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.
|
|
tags:
|
|
analytic_story:
|
|
- Prohibited Traffic Allowed or Protocol Mismatch
|
|
- Ransomware
|
|
- NOBELIUM Group
|
|
- Command And Control
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
impact: 100
|
|
message: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$
|
|
mitre_attack_id:
|
|
- T1090
|
|
- T1090.003
|
|
observable:
|
|
- name: src_ip
|
|
type: IP Address
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- All_Traffic.app
|
|
- All_Traffic.action
|
|
- All_Traffic.src_ip
|
|
- All_Traffic.dest_ip
|
|
- All_Traffic.dest_port
|
|
risk_score: 80
|
|
security_domain: network
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log
|
|
source: pan_tor_allowed
|
|
sourcetype: pan:traffic
|