Detection: Cisco Secure Firewall - Repeated Malware Downloads

Updated Date: 2025-04-09 ID: aeff2bb5-3483-48d4-9be8-c8976194be1e Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects repeated malware file downloads initiated by the same internal host (src_ip) within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies FileEvent events with a SHA_Disposition of "Malware" and FileDirection set to "Download". If ten or more such events occur from the same host within five minutes, this analytic will trigger. This activity may indicate the host is compromised and repeatedly retrieving malicious content—either due to command-and-control, malware staging, or automation. If confirmed malicious, this behavior may represent an infection in progress, persistence mechanism, or a malicious downloader.

 1`cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download"
 2
 3| lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
 4
 5| bin _time span=5m 
 6
 7| stats count min(_time) as firstTime max(_time) as lastTime
 8        values(uri) as uri
 9        values(ClientApplication) as ClientApplication
10        values(app) as app
11        values(file_hash) as file_hash
12        values(SHA_Disposition) as SHA_Disposition
13        values(file_name) as file_name
14        values(ThreatName) as ThreatName
15        values(dest) as dest
16        values(dest_port) as dest_port
17        by src_ip FileDirection FileType Description
18
19| where count >= 10
20
21| `security_content_ctime(firstTime)`
22
23| `security_content_ctime(lastTime)`
24
25| table firstTime lastTime src_ip dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
26
27| `cisco_secure_firewall___repeated_malware_downloads_filter`

Data Source

Name Platform Sourcetype Source
Cisco Secure Firewall Threat Defense File Event N/A 'cisco:sfw:estreamer' 'not_applicable'

Macros Used

Name Value
cisco_secure_firewall sourcetype="cisco:sfw:estreamer"
cisco_secure_firewall___repeated_malware_downloads_filter search *
cisco_secure_firewall___repeated_malware_downloads_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1105 Ingress Tool Transfer Command And Control
T1027 Obfuscated Files or Information Defense Evasion
Command and Control
Exploitation
DE.AE
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the FileEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The malware & file access policy must also enable logging.

Known False Positives

False positives should be minimal here, tuning may be required to exclude known test machines or development hosts.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Repeated malware file downloads detected from $src_ip$ involving $ThreatName$.

Risk Object Risk Object Type Risk Score Threat Objects
src_ip system 30 file_hash, file_name

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset not_applicable cisco:sfw:estreamer
Integration ✅ Passing Dataset not_applicable cisco:sfw:estreamer

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1