Try in Splunk Security Cloud

Description

The following analytic detects high volume of bytes out (greater than 1GB) to a URL within 2 mins of time window. This may be indicative of an attacker attempting to exfiltrate data. The search applies a fundamental threshold for detecting significant web uploads. This approach aims to identify potential data exfiltration activities by malware or malevolent insiders. View the alert for $dest$ to investigate further.

  • Type: Anomaly
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Web
  • Last Updated: 2024-02-22
  • Author: Bhavin Patel, Splunk
  • ID: c8a6b56d-16dd-4e9c-b4bd-527742ead98d

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1567 Exfiltration Over Web Service Exfiltration
Kill Chain Phase
  • Actions On Objectives
NIST
  • DE.AE
CIS20
  • CIS 13
CVE 


1
2
3
4
5



| tstats  `security_content_summariesonly` count sum(Web.bytes_out) as sum_bytes_out values(Web.user) as user values(Web.app) as app values(Web.dest) as dest from datamodel=Web by _time span=2m Web.url Web.src sourcetype 
| search sum_bytes_out > 1070000000 
| `drop_dm_object_name("Web")`
| `high_volume_of_bytes_out_to_url_filter`

Macros

The SPL above uses the following Macros:

:information_source: high_volume_of_bytes_out_to_url_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Web.http_method
  • Web.url
  • Web.url_length
  • Web.src
  • Web.dest
  • Web.http_user_agent

How To Implement

To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the Web datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior.

Known False Positives

This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
9.0 30 30 A high volume of bytes out to a URL $url$ was detected from src $src$ to dest $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1