| ID | Technique | Tactic |
|---|---|---|
| T1059 | Command and Scripting Interpreter | Execution |
Detection: Cisco NVM - Browser Spawned Unix Shell with External Connection
Description
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Search
1`cisco_network_visibility_module_flowdata`
2process_path IN (
3 "*/bash",
4 "*/csh",
5 "*/dash",
6 "*/fish",
7 "*/sh",
8 "*/tcsh",
9 "*/zsh"
10)
11parent_process_path IN (
12 "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin",
13 "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera",
14 "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox"
15)
16NOT dest IN (
17 "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
18 "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
19 "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
20 "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
21 "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
22 )
23
24
25| stats count
26 min(_time) as firstTime
27 max(_time) as lastTime
28 values(parent_process_hash) as parent_process_hash
29 values(process_hash) as process_hash
30 values(module_name_list) as module_name_list
31 values(module_hash_list) as module_hash_list
32 values(dest_port) as dest_port
33 values(dest_hostname) as dest_hostname
34
35 by src src_ip dest dest_ip bytes_in bytes_out
36 user process_id process_name process_path process
37 parent_process_id parent_process_name parent_process_path parent_process
38
39
40| table
41 firstTime lastTime user
42 parent_process_path parent_process_name parent_process parent_process_hash
43 process_path process_name process process_hash process_id
44 module_name_list module_hash_list
45 src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out
46
47
48| `security_content_ctime(firstTime)`
49
50| `security_content_ctime(lastTime)`
51
52| `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter`
Data Source
| Name | Platform | Sourcetype | Source |
|---|---|---|---|
| Cisco Network Visibility Module Flow Data |  Network |
'cisco:nvm:flowdata:v2' |
'not_applicable' |
Macros Used
| Name | Value |
|---|---|
| security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
| cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter | search * |
cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Installation
DE.AE
CIS 10
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | 0 * * * * |
| Earliest Time | -70m@m |
| Latest Time | -10m@m |
| Schedule Window | auto |
| Creates Finding (Notable) | No |
| Creates Intermediate Finding (Risk Event) | Yes |
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.
Implementation
This search requires Network Visibility Module logs, which includes the flow data sourcetype.
This search uses an input macro named cisco_network_visibility_module_flowdata.
We strongly recommend that you specify your environment-specific configurations
(index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
Replace the macro definition with configurations for your Splunk environment.
The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
Known False Positives
Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.
Associated Analytic Story
Intermediate Findings
| Message | Entity Field | Entity Type | Risk Score |
|---|---|---|---|
| A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. | src | system | 20 |
Threat Objects
| Field | Type |
|---|---|
| dest_hostname | domain |
| process | process |
| dest_ip | ip_address |
References
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | ✅ Passing | N/A | N/A | N/A |
| Unit | ✅ Passing | Dataset | not_applicable |
cisco:nvm:flowdata:v2 |
| Integration | ✅ Passing | Dataset | not_applicable |
cisco:nvm:flowdata:v2 |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub |
Version: 1