Detection: Cisco Secure Firewall - File Download Over Uncommon Port

Description

The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.

Search

 1`cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443)
 2
 3| lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
 4
 5| stats count min(_time) as firstTime max(_time) as lastTime
 6        values(file_name) as file_name
 7        values(uri) as uri
 8        values(ClientApplication) as ClientApplication
 9        values(file_hash) as file_hash
10        values(SHA_Disposition) as SHA_Disposition
11        by FileDirection FileType app ThreatName dest_port Description src dest
12
13| `security_content_ctime(firstTime)`
14
15| `security_content_ctime(lastTime)`
16
17| table firstTime lastTime src dest dest_port FileDirection FileType Description uri ClientApplication file_name file_hash SHA_Disposition ThreatName
18
19| `cisco_secure_firewall___file_download_over_uncommon_port_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the FileEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The malware & file access policy must also enable logging.

Known False Positives

Some legitimate applications may download files over custom ports (e.g., CDN mirrors, APIs). Apply additional filters accordingly.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

Intermediate Findings

Threat Objects

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 8