Detection: Cisco NVM - Suspicious Network Connection Initiated via MsXsl

Description

This analytic identifies the use of msxsl.exe initiating a network connection to a non-private IP address. Although msxsl.exe is a legitimate Microsoft utility used to apply XSLT transformations, adversaries can abuse it to execute arbitrary code or load external resources in an evasive manner. This detection leverages Cisco NVM telemetry to identify potentially malicious use of msxsl.exe making network connections that may indicate command and control (C2) or data exfiltration activity.

Search

 1`cisco_network_visibility_module_flowdata`
 2process_name = "msxsl.exe"
 3NOT dest IN (
 4        "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
 5        "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
 6        "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
 7        "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
 8        "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
 9        )
10
11| stats count min(_time) as firstTime max(_time) as lastTime
12        values(parent_process_arguments) as parent_process_arguments
13        values(process_arguments) as process_arguments
14        values(parent_process_hash) as parent_process_hash
15        values(process_hash) as process_hash
16        values(module_name_list) as module_name_list
17        values(module_hash_list) as module_hash_list
18        values(dest_port) as dest_port
19        values(aliul) as additional_logged_in_users_list
20        values(dest_hostname) as dest_hostname
21        by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
22
23| `security_content_ctime(firstTime)`
24
25| `security_content_ctime(lastTime)`
26
27| table
28  parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
29  process_integrity_level process_path process_name process_arguments process_hash process_id
30  additional_logged_in_users_list module_name_list module_hash_list
31  src dest_hostname dest dest_port transport firstTime lastTime
32
33| `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Network Visibility Module Flow Data	Network	'cisco:nvm:flowdata'	'not_applicable'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named cisco_network_visibility_module_flowdata. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).

Known False Positives

False positives may occur in development or administrative environments where msxsl.exe is used for legitimate XML transformations. However, its use is uncommon in standard user activity and should be reviewed in most environments.

Associated Analytic Story

• Cisco Network Visibility Module Analytics

Risk Based Analytics (RBA)

Risk Message:

Host $src$ used msxsl.exe to initiate a suspicious network connection to $dest$

References

• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1