Detection: Cisco SA - Access to Anonymizer Services

Updated Date: 2026-06-09 ID: a7c8613a-92e2-4232-b64d-bd39d33dee8b Author: Mahamudul Chowdhury, Bhavin Patel, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry. Users who reach anonymizer or proxy-evasion infrastructure are often trying to bypass corporate controls such as secure web gateway inspection, DLP monitoring, CASB visibility, and threat-detection systems. These services frequently establish encrypted tunnels that hide subsequent traffic from inspection. Early identification helps security teams spot circumvention attempts before potential data exfiltration or follow-on malicious activity. Correlating DNS resolution and proxy session data strengthens confidence that access was intentional.

Search

 1`cisco_secure_access_dns`
 2action = "allowed" category= "*anonymizer*"
 3
 4| fillnull
 5
 6| stats count min(_time) as firstTime max(_time) as lastTime values(domain) as domain values(query) as query values(reply_code) as reply_code values(record_type) as record_type by src_ip src_external_ip user identity_type action category sourcetype
 7
 8| `security_content_ctime(firstTime)`
 9
10| `security_content_ctime(lastTime)`
11
12| `cisco_sa___access_to_anonymizer_services_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Secure Access DNS	Other	`'cisco:cloud_security:dns'`	`'not_applicable'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
cisco_sa___access_to_anonymizer_services_filter	`search *`

cisco_sa___access_to_anonymizer_services_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1090.003	Multi-hop Proxy	Command and Control

Command and Control

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Ingest Cisco Secure Access DNS and proxy events into Splunk using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). Update the cisco_secure_access_dns macro so it resolves to the indexes, sources, and sourcetypes used in your environment.

Known False Positives

Security research, approved privacy tools, or mis-categorized destinations may appear as anonymizer traffic. Tune this analytic with the filter macro or allow-lists for known-good users, networks, and domains after validating business justification.

Associated Analytic Story

Cisco Secure Access Analytics

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
User $user$ from $src_ip$ accessed proxy-evasion or anonymizer infrastructure (domains=$domain$, categories=$category$).	user	user	20

Threat Objects

Field	Type
domain	domain

References

https://attack.mitre.org/techniques/T1090/003

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:cloud_security:dns`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:cloud_security:dns`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1