Detection: Cisco Secure Firewall - Oracle E-Business Suite Correlation

Updated Date: 2025-10-23 ID: 9e995d21-6870-43de-acd9-76f372bcf323 Author: Nasreddine Bencherchali, Splunk, Talos NTDR Type: TTP Product: Splunk Enterprise Security

Description

This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs. The detection looks for specific signatures that indicate attempts to exploit the TemplatePreview functionality and vulnerable SyncServlet endpoints as well as post compromise activity involving Cl0p. By correlating these signatures, the analytic aims to identify coordinated exploitation attempts that may indicate an attacker is targeting Oracle E-Business Suite installations. Security teams should investigate any instances of these correlated signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.

Search

 1`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (65454, 65455, 65377, 65378, 65413, 65414, 65415, 65456)
 2
 3| bin _time span=5m
 4
 5| fillnull
 6
 7| stats dc(signature_id) as unique_signature_count 
 8        values(signature_id) as signature_id 
 9        values(signature) as signature 
10        values(class_desc) as class_desc 
11        values(MitreAttackGroups) as MitreAttackGroups 
12        values(InlineResult) as InlineResult 
13        values(InlineResultReason) as InlineResultReason 
14        values(dest_port) as dest_port 
15        values(rule) as rule 
16        values(transport) as transport 
17        values(app) as app 
18        min(_time) as firstTime 
19        max(_time) as lastTime 
20        sum(eval(signature_id==65454)) as sig_template_preview
21        sum(eval(signature_id==65455)) as sig_sync_servlet
22        sum(eval(signature_id IN (65377,65378,65413,65414,65415,65456))) as sig_exploit_activity
23  by src_ip dest_ip
24
25| where (
26          (
27            sig_exploit_activity >= 1 
28            AND 
29            (
30              sig_template_preview >= 1 
31              OR 
32              sig_sync_servlet >= 1
33            )
34          )
35        OR
36          (
37            sig_template_preview >= 1
38            AND 
39            sig_sync_servlet >= 1
40          )
41        OR
42          unique_signature_count >= 2
43        )
44
45| `security_content_ctime(firstTime)`
46
47| `security_content_ctime(lastTime)`
48
49| `cisco_secure_firewall___oracle_e_business_suite_correlation_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Secure Firewall Threat Defense Intrusion Event	N/A	`'cisco:sfw:estreamer'`	`'not_applicable'`

Macros Used

Name	Value
cisco_secure_firewall	`sourcetype="cisco:sfw:estreamer"`
cisco_secure_firewall___oracle_e_business_suite_correlation_filter	`search *`

cisco_secure_firewall___oracle_e_business_suite_correlation_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.CM

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the IntrusionEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The intrusion access policy must also be configured.

Known False Positives

False positives should be very unlikely.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Multiple Oracle E-Business Suite exploitation signatures $signature_id$ detected from source IP $src_ip$ to destination IP $dest_ip$

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest_ip	system	25	src_ip, signature

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:sfw:estreamer`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:sfw:estreamer`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1