From 149b36260263fe9c56be9cb2fd5385d31f032a11 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Jul 2025 09:09:17 -0700 Subject: [PATCH 1/2] updating spl --- ...sco_nvm___installation_of_typosquatted_python_package.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 52f30f90f2..f9884d15ef 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -34,14 +34,13 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport package_name comment package_official_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table + | table firstTime lastTime src dest_hostname dest dest_port transport package_name comment package_official_url parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list - src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___installation_of_typosquatted_python_package_filter` how_to_implement: | This search requires Network Visibility Module logs, which includes the flow data sourcetype. From 9bc9e5f6499e742f60ebea2e89726b452c648798 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Jul 2025 09:15:47 -0700 Subject: [PATCH 2/2] adding parent process name --- ...__suspicious_file_download_via_headless_browser.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index ac7c7c6304..c3898b7a5f 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -13,7 +13,7 @@ description: | data_source: - Cisco Network Visibility Module Flow Data search: | - `cisco_network_visibility_module_flowdata` + `cisco_network_visibility_module_flowdata` ``` Usually the initiator of the connection is the child process, meaning the parent will contain the suspicious command.``` @@ -40,7 +40,7 @@ search: | | rex field=parent_process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | rex field=process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | eval direct_ip_match=if(dest == extracted_ip_child, 1, if(dest == extracted_ip_parent, 1, 0)) - + | where ( dest_hostname IN ( "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", @@ -53,7 +53,7 @@ search: | ) OR direct_ip_match = 1 ) - + | stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_arguments) as parent_process_arguments values(process_arguments) as process_arguments @@ -64,11 +64,11 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table - parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash + parent_process_integrity_level parent_process_path parent_process_name parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime