security_content/detections/network/detect_remote_access_software_usage_traffic.yml at develop · ryanbsaunders/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Detect Remote Access Software Usage Traffic
id: 885ea672-07ee-475a-879e-60d28aa5dd42
version: 11
date: '2025-10-14'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects network traffic associated with
  known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn,
  and TeamViewer. It leverages Palo Alto traffic logs mapped to the
  Network_Traffic data model in Splunk. This activity is significant because
  adversaries often use remote access tools to maintain unauthorized access to
  compromised environments. If confirmed malicious, this activity could allow
  attackers to control systems remotely, exfiltrate data, or deploy additional
  malware, posing a severe threat to the organization's security.
data_source:
- Palo Alto Network Traffic
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(All_Traffic.dest_port) as dest_port latest(All_Traffic.user)
  as user from datamodel=Network_Traffic by All_Traffic.action All_Traffic.app All_Traffic.bytes
  All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip
  All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version
  All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user
  All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | lookup remote_access_software remote_appid
  AS app OUTPUT isutility, description as signature, comment_reference as desc, category
  | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter`'
how_to_implement: The following analytic was developed with Palo Alto traffic
  logs. Ensure that the logs are being ingested into Splunk and mapped to the
  Network_Traffic data model. Use the Splunk Common Information Model (CIM) to
  normalize the field names and speed up the data modeling process. The
  "exceptions" macro leverages both an Assets and Identities lookup, as well as
  a KVStore collection called "remote_software_exceptions" that lets you track
  and maintain device- based exceptions for this set of detections.
known_false_positives: It is possible that legitimate remote access software is
  used within the environment. Ensure that the lookup is reviewed and updated
  with any additional remote access software that is used within the
  environment. Known false positives can be added to the
  remote_access_software_usage_exception.csv lookup to globally suppress these
  situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://applipedia.paloaltonetworks.com/
drilldown_searches:
- name: View the detection results for - "$src$"
  search: '%original_detection_search% | search  src = "$src$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: Investigate application traffic for $app$
  search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: Application traffic for a known remote access software [$signature$]
    was detected from $src$.
  risk_objects:
  - field: src
    type: system
    score: 25
  - field: user
    type: user
    score: 25
  threat_objects:
  - field: signature
    type: signature
tags:
  analytic_story:
  - Insider Threat
  - Command And Control
  - Ransomware
  - Remote Monitoring and Management Software
  - Scattered Spider
  - Interlock Ransomware
  - Scattered Lapsus$ Hunters
  asset_type: Network
  mitre_attack_id:
  - T1219
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: network
  manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
  attack_data:
  - data:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo_traffic.log
    source: screenconnect_palo_traffic
    sourcetype: pan:traffic