Skip to content

Revamp Cisco FTD and its Dependent Detections #4328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
onurmerdogan wants to merge 10 commits into
base: develop
Choose a base branch
from
+2,992 −762
Open

Revamp Cisco FTD and its Dependent Detections #4328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
0bd495e
Revamp Cisco FTD and its Dependent Detections
onurmerdogan Oct 8, 2026
15845b7
Merge branch 'develop' into revamp_cisco_ftd_detections
onurmerdogan Oct 9, 2026
72091de
Merge branch 'develop' into revamp_cisco_ftd_detections
onurmerdogan Oct 13, 2026
b4e9d86
update zeek encoding detection
onurmerdogan Oct 13, 2026
0c5d374
Update http_post_request_with_encoded_payload.yml
nasbench Oct 14, 2026
5658c5c
Update http_post_request_with_encoded_payload.yml
onurmerdogan Oct 15, 2026
bc42eca
fixing yaml format errors
onurmerdogan Oct 15, 2026
f269721
fixing url field generation
onurmerdogan Oct 15, 2026
5772886
fixing by clause
onurmerdogan Oct 16, 2026
0e928a9
Update http_post_request_with_encoded_payload.yml
onurmerdogan Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 38 additions & 21 deletions detections/endpoint/detect_remote_access_software_usage_file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
name: Detect Remote Access Software Usage File
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
version: 17
version: 18
creation_date: '2024-03-06'
modification_date: '2026-09-22'
author: Steven Dick
modification_date: '2026-10-08'
author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |
Expand All @@ -21,31 +21,48 @@ search: |
count min(_time) as firstTime,
max(_time) as lastTime
values(Filesystem.file_path) as file_path
from datamodel=Endpoint.Filesystem
where Filesystem.file_name IN (
"*.app",
"*.exe",
"*.msi",
"*.pkg",
"*echoware.dll",
"*Idrive.*",
"*rdp2tcp.py"
)
by Filesystem.action Filesystem.dest Filesystem.file_access_time
FROM datamodel=Endpoint.Filesystem
WHERE
[
| inputlookup remote_access_software
| search file_name!=""
| rename file_name as Filesystem.file_name
| table Filesystem.file_name
]
OR
[
| inputlookup remote_access_software
| search file_path!=""
| rename file_path as Filesystem.file_path
| table Filesystem.file_path
]

BY Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size
Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`

| lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description
| lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name(Filesystem)`
| lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category
| search isutility = TRUE
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
how_to_implement: |-
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to
provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest
logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate
Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The
"exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: |-
Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the
remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
Expand All @@ -68,11 +85,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$].
- field: user
type: user
score: 20
message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$].
threat_objects:
- field: file_name
type: file_name
Expand Down
59 changes: 39 additions & 20 deletions detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,49 @@
name: Detect Remote Access Software Usage FileInfo
id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
version: 16
version: 17
creation_date: '2024-03-06'
modification_date: '2026-09-22'
author: Steven Dick
modification_date: '2026-10-08'
author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
description: |-
The following analytic detects the execution of processes with file or code signing attributes from known remote access software within
the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk,
GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access.
If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further
compromise of the network.
data_source:
- Sysmon EventID 1
search: |-
`sysmon` EventCode=1
| stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product
BY action dest original_file_name
parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path
process process_exec process_guid
process_hash process_id process_integrity_level
process_name process_path user
user_id vendor_product
| lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category
| search isutility = True
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_fileinfo_filter`
how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
[
| inputlookup remote_access_software
| search file_info!=""
| rename file_info as Product
| table Product
]

| stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product
BY action dest original_file_name
parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path
process process_exec process_guid
process_hash process_id process_integrity_level
process_name process_path user
user_id vendor_product
| lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_fileinfo_filter`
how_to_implement: |-
This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for
Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a
KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: |-
Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the
remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
Expand All @@ -47,11 +66,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].
- field: user
type: user
score: 20
message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].
threat_objects:
- field: process_name
type: process_name
Expand Down
63 changes: 45 additions & 18 deletions detections/endpoint/detect_remote_access_software_usage_process.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,35 +1,62 @@
name: Detect Remote Access Software Usage Process
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
version: 18
version: 19
creation_date: '2024-03-06'
modification_date: '2026-10-09'
author: Steven Dick, Sebastian Wurl, Splunk Community
modification_date: '2026-10-08'
author: Steven Dick, Sebastian Wurl, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
description: |-
The following analytic detects the execution of known remote access software within the environment. It leverages data from
Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model.
We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity
is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized
access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional
malware, posing a severe threat to the organization's security.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
from datamodel=Endpoint.Processes
where
[| inputlookup remote_access_software where isutility=TRUE
| rename remote_utility AS Processes.process_name
| fields Processes.process_name]
| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime
values(Processes.parent_process) as parent_process
FROM datamodel=Endpoint.Processes
WHERE
[
| inputlookup remote_access_software
| search file_name!=""
| rename file_name as Processes.process_name
| table Processes.process_name
]

AND Processes.dest!="unknown"
AND Processes.user!="unknown"
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`

| lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)`
| lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
| search isutility = TRUE
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
how_to_implement: |-
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name,
and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology
Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common
Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities
lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
known_false_positives: |-
It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional
remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup
to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
Expand Down Expand Up @@ -63,11 +90,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
message: A process for a known remote access software $process_name$ was identified on $dest$.
message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$].
- field: user
type: user
score: 20
message: A process for a known remote access software $process_name$ was identified on $dest$.
message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$].
threat_objects:
- field: process_name
type: process_name
Expand Down
Loading
Loading