Detection: Cisco Secure Firewall - High Priority Intrusion Classification

Description

This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as:

• A Network Trojan was Detected
• Successful Administrator Privilege Gain
• Successful User Privilege Gain
• Attempt to Login By a Default Username and Password
• Known malware command and control traffic
• Known malicious file or file based exploit
• Known client side exploit attempt
• Large Scale Information Leak"

These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.

Search

 1`cisco_secure_firewall` EventType=IntrusionEvent 
 2        class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak")
 3
 4| fillnull
 5
 6| stats count min(_time) as firstTime max(_time) as lastTime
 7        values(signature_id) as signature_id 
 8        values(MitreAttackGroups) as MitreAttackGroups 
 9        values(InlineResult) as InlineResult 
10        values(InlineResultReason) as InlineResultReason 
11        values(dest_port) as dest_port 
12        values(rule) as rule 
13        values(transport) as transport 
14        values(app) as app
15        by src_ip, dest_ip, signature, class_desc
16
17| `security_content_ctime(firstTime)`
18
19| `security_content_ctime(lastTime)`
20
21| `cisco_secure_firewall___high_priority_intrusion_classification_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the IntrusionEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The intrusion access policy must also be configured.

Known False Positives

Some intrusion events that are linked to these classifications might be noisy in certain environments. Apply a combination of filters for specific snort IDs and other indicators.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

Risk Based Analytics (RBA)

Risk Message:

A high priority intrusion event with classification ($class_desc$) was detected from $src_ip$ to $dest_ip$, indicating potential suspicious activity.

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1