Detection: Cisco NVM - Osascript Network Connection for a Long Duration

Description

This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.

Search

1`cisco_network_visibility_module_flowdata`
2(
3    parent_process_name="osascript"
4    OR
5    process_name="osascript"
6)

FSS stands for Flow Start Seconds FES stands for Flow End Seconds

 1
 2| eval duration=fes-fss
 3
 4
 5| where duration>600
 6
 7
 8| stats count min(_time) as firstTime
 9              max(_time) as lastTime
10              values(parent_process_hash) as parent_process_hash
11              values(process_hash) as process_hash
12              values(dest_port) as dest_port
13              values(dest_hostname) as dest_hostname
14              values(http_method) as http_method
15by src dest transport parent_process_path parent_process_name
16   parent_process parent_process_id process_path process_name
17   process process_id user duration
18
19
20| eval duration=tostring(duration)." seconds"
21
22
23| `security_content_ctime(firstTime)`
24
25| `security_content_ctime(lastTime)`
26
27| `cisco_nvm___osascript_network_connection_for_a_long_duration_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Network Visibility Module Flow Data	Network	'cisco:nvm:flowdata:v2'	'not_applicable'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named cisco_network_visibility_module_flowdata. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).

Known False Positives

Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations.

Associated Analytic Story

• MacOS Post-Exploitation

• Command And Control

• Cisco Network Visibility Module Analytics

Intermediate Findings

Threat Objects

References

• https://attack.mitre.org/techniques/T1071/001/

• https://attack.mitre.org/tactics/TA0002/

• https://attack.mitre.org/tactics/TA0011/

• https://attack.mitre.org/techniques/T1059/002/

• https://www.loobins.io/binaries/osascript/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1