Detection: Cisco ASA - Device File Copy to Remote Location

Updated Date: 2025-11-18 ID: 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. Adversaries may exfiltrate device files including configurations, logs, packet captures, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure. The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands with remote protocol indicators (tftp:, ftp:, http:, https:, smb:, scp:). Investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows. We recommend adapting the detection filters to exclude known legitimate backup activities.

Search

 1`cisco_asa`
 2message_id IN (111008, 111010)
 3command = "copy *"
 4command IN (
 5    "*running-config*",
 6    "*startup-config*",
 7    "*/pcap capture:*",
 8    "* disk0:*",
 9    "* flash:*",
10    "* system:*"
11)
12command IN (
13    "*ftp:*",
14    "*http:*",
15    "*https:*",
16    "*smb:*",
17    "*scp:*"
18)
19
20
21| eval remote_protocol = mvappend(
22  if(match(command, "tftp:"), "TFTP", null()),
23  if(match(command, "ftp:"), "FTP", null()),
24  if(match(command, "http:"), "HTTP", null()),
25  if(match(command, "https:"), "HTTPS", null()),
26  if(match(command, "smb:"), "SMB", null()),
27  if(match(command, "scp:"), "SCP", null())
28  )
29
30| fillnull
31
32| stats earliest(_time) as firstTime
33        latest(_time) as lastTime
34        values(user) as user
35        values(action) as action
36        values(message_id) as message_id
37        values(command) as command
38        values(remote_protocol) as remote_protocol
39        values(src_ip) as src_ip
40        values(dest) as dest
41        values(process_name) as process_name
42  by host
43
44| `security_content_ctime(firstTime)`
45
46| `security_content_ctime(lastTime)`
47
48| `cisco_asa___device_file_copy_to_remote_location_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco ASA Logs	Other	`'cisco:asa'`	`'not_applicable'`

Macros Used

Name	Value
cisco_asa	`sourcetype=cisco:asa`
cisco_asa___device_file_copy_to_remote_location_filter	`search *`

cisco_asa___device_file_copy_to_remote_location_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1005	Data from Local System	Collection
T1041	Exfiltration Over C2 Channel	Exfiltration
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration

Actions on Objectives

Exploitation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message IDs 111008 and 111010. If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and add message IDs 111008 and 111010. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Legitimate configuration exports to remote locations may occur during normal administrative activities. Investigate these events to verify their legitimacy and apply necessary filters.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

User $user$ executed command $command$ to copy file or config from Cisco ASA host $host$ to remote location $dest$ via $remote_protocol$ protocols.

Risk Object	Risk Object Type	Risk Score	Threat Objects
user	user	50	dest, command
host	system	50	dest, command

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:asa`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:asa`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1