Detection: Cisco ASA - Device File Copy Activity

Description

This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity. The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations. Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.

Search

 1`cisco_asa`
 2message_id IN (111008, 111010)
 3command = "copy *"
 4command IN (
 5    "*running-config*",
 6    "*startup-config*",
 7    "*/pcap capture:*",
 8    "* disk0:*",
 9    "* flash:*",
10    "* system:*"
11)
12
13| fillnull
14
15| stats earliest(_time) as firstTime
16        latest(_time) as lastTime
17        values(user) as user
18        values(action) as action
19        values(message_id) as message_id
20        values(command) as command
21        values(src_ip) as src_ip
22        values(process_name) as process_name
23  by host
24
25| `security_content_ctime(firstTime)`
26
27| `security_content_ctime(lastTime)`
28
29| `cisco_asa___device_file_copy_activity_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010. If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.

Associated Analytic Story

• ArcaneDoor

• Suspicious Cisco Adaptive Security Appliance Activity

Risk Based Analytics (RBA)

Risk Message:

User $user$ executed command $command$ to export device configuration from Cisco ASA host $host$.

References

• https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1