Detection: Cisco Secure Firewall - Malware File Downloaded

Description

The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the SHA_Disposition field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.

Search

 1`cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download"
 2
 3| lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
 4
 5| stats count min(_time) as firstTime max(_time) as lastTime
 6        values(uri) as uri
 7        values(ClientApplication) as ClientApplication
 8        values(file_hash) as file_hash
 9        by FileDirection dest src_ip dest_port FileType app file_name ThreatName Description
10
11| `security_content_ctime(firstTime)`
12
13| `security_content_ctime(lastTime)`
14
15| table firstTime lastTime src_ip dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
16
17| `cisco_secure_firewall___malware_file_downloaded_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the FileEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The malware & file access policy must also enable logging.

Known False Positives

Malicious verdicts could be outdated or incorrect due to retroactive threat intel.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

Risk Based Analytics (RBA)

Risk Message:

File with Malware disposition downloaded from $dest$ over port $dest_port$ by $src_ip$

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2