Detection: Cisco Secure Firewall - Potential Data Exfiltration

Description

The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. It leverages Cisco Secure Firewall Threat Defense ConnectionEvent logs and thresholds on InitiatorBytes (bytes transmitted by the initiator), which for typical inside-initiated client sessions approximates upload or outbound payload from the internal host and avoids flagging large downloads where most bytes appear in ResponderBytes. Connections where the initiator sent at least 100 MB are flagged, as these may indicate unauthorized data exfiltration, especially if associated with unusual users, hosts, or processes. This analytic is scoped to inside-to-outside flows using a macro (cisco_secure_firewall_inside_to_outside) to abstract environment-specific zone definitions. If confirmed malicious, this behavior may reflect data staging and exfiltration over an encrypted or stealthy transport.

Search

 1`cisco_secure_firewall` EventType=ConnectionEvent `cisco_secure_firewall_inside_to_outside`
 2
 3| eval initiator_mb = round(InitiatorBytes / 1024 / 1024, 2)
 4
 5| where initiator_mb >= 100
 6
 7| eval Potentially_Exfiltrated = initiator_mb + " MB"
 8
 9| stats min(_time) as firstTime max(_time) as lastTime
10    Values(url) as url
11    Values(rule) as rule
12    Values(dest_port) as dest_port
13    by src, dest, Potentially_Exfiltrated, transport, action
14
15| `security_content_ctime(firstTime)`
16
17| `security_content_ctime(lastTime)`
18
19| `cisco_secure_firewall___potential_data_exfiltration_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. This search uses two input macros named cisco_secure_firewall and cisco_secure_firewall_inside_to_outside. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definitions with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging.

Known False Positives

Large initiator-side transfers may occur due to legitimate activities such as cloud backups, file syncing, or developer build deployments. Backup servers, CI/CD pipelines, and enterprise sync tools (e.g., OneDrive, Dropbox) may exhibit similar patterns. Uncommon connection initiation (e.g., certain server-initiated or asymmetric paths) can change which side is logged as the initiator; tune or filter those scenarios if needed. Additional validation using user context, scheduled task windows, or endpoint telemetry is recommended to reduce false positives.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

Risk Based Analytics (RBA)

Risk Message:

Potential data exfiltration activity from $src$ to $dest$ — With $Potentially_Exfiltrated$ transferred (initiator bytes)

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 6