Detection: Cisco Secure Firewall - Connection to File Sharing Domain

Description

The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.

Search

 1`cisco_secure_firewall`
 2action IN ("Trust", "Allow", "allowed")
 3EventType=ConnectionEvent
 4[
 5    
 6| inputlookup file_sharing_domains_lookup
 7    
 8| table domain
 9    
10| rename domain as url
11]
12
13
14| lookup local=t file_sharing_domains_lookup domain as url OUTPUT description
15
16
17| where match(url, "(?i)\b".description."\b")
18
19
20| stats count min(_time) as firstTime
21              max(_time) as lastTime
22              values(src_port) as src_port
23              values(dest) as dest
24              values(dest_port) as dest_port
25              values(rule) as rule
26              values(url) as url
27              values(EVE_Process) as EVE_Process
28
29  by src transport action
30
31
32| `security_content_ctime(firstTime)`
33
34| `security_content_ctime(lastTime)`
35
36| `cisco_secure_firewall___connection_to_file_sharing_domain_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Secure Firewall Threat Defense Connection Event	Network	'cisco:sfw:estreamer'	'not_applicable'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging.

Known False Positives

Legitimate users and applications may use these domains for benign purposes such as file transfers, collaborative development, or storing public content. Developer tools, browser extensions, or open-source software may connect to githubusercontent.com or cdn.discordapp.com as part of normal operation. It is recommended to review the associated process (EVE_Process), user behavior, and frequency of access before classifying the activity as suspicious.

Associated Analytic Story

• Scattered Lapsus$ Hunters

• Cisco Secure Firewall Threat Defense Analytics

Intermediate Findings

Threat Objects

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 11