GitHub Repo

Data Source: Cisco Network Visibility Module Flow Data

Date: 2026-05-13

ID: d49bcd3c-da06-41c6-b33e-8b8d23078f68

Author: Nasreddine Bencherchali, Splunk

Description

Data source object for Netflow events from Cisco Network Visibility Module

Details

Property Value
Source not_applicable
Sourcetype cisco:nvm:flowdata
Name ▲▼ Technique ▲▼ Type ▲▼
Windows InstallUtil URL in Command Line InstallUtil TTP
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Mshta Anomaly
Cisco NVM - Susp Script From Archive Triggering Network Activity Visual Basic, Malicious File Anomaly
Windows PowerShell FakeCAPTCHA Clipboard Execution PowerShell, Windows Command Shell, Malicious Link TTP
Cisco NVM - Outbound Connection to Suspicious Port Non-Standard Port Anomaly
Windows HTTP Network Communication From MSIExec Msiexec Anomaly
Cisco NVM - Suspicious Network Connection to IP Lookup Service API System Network Configuration Discovery, IP Addresses Anomaly
Cisco NVM - Curl Execution With Insecure Flags BITS Jobs Anomaly
WMIC XSL Execution via URL XSL Script Processing TTP
Windows Curl Upload to Remote Destination Ingress Tool Transfer TTP
Cisco NVM - Suspicious File Download via Headless Browser Command and Scripting Interpreter, Ingress Tool Transfer TTP
Cisco NVM - Suspicious Network Connection From Process With No Args Process Injection, System Binary Proxy Execution Anomaly
Windows File Download Via CertUtil Ingress Tool Transfer TTP
Detect HTML Help URL in Command Line Compiled HTML File TTP
Windows Curl Download to Suspicious Path Ingress Tool Transfer TTP
Cisco NVM - Non-Network Binary Making Network Connection Masquerading, Process Injection Anomaly
Cisco NVM - Suspicious Network Connection Initiated via MsXsl XSL Script Processing Anomaly
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Visual Basic, Mshta Anomaly
Windows MSIExec Remote Download Msiexec Anomaly
Cisco NVM - Installation of Typosquatted Python Package Command and Scripting Interpreter TTP
Cisco NVM - Suspicious Download From File Sharing Website BITS Jobs Anomaly
Detect RClone Command-Line Usage Automated Exfiltration TTP
Windows File Download Via PowerShell PowerShell, Ingress Tool Transfer Anomaly
Attacker Tools On Endpoint OS Credential Dumping, Match Legitimate Resource Name or Location, Active Scanning TTP
Windows InstallUtil Remote Network Connection InstallUtil Anomaly
Detect MSHTA Url in Command Line Mshta TTP
Cisco NVM - Rclone Execution With Network Activity Exfiltration to Cloud Storage Anomaly
Cisco NVM - Webserver Download From File Sharing Website Ingress Tool Transfer, Exploit Public-Facing Application TTP

Supported Apps

Event Fields

+ Fields 
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">aditional_logged_in_user_list</span>
  
  <span class="pill kill-chain">aliul</span>
  
  <span class="pill kill-chain">bytes</span>
  
  <span class="pill kill-chain">bytes_in</span>
  
  <span class="pill kill-chain">bytes_out</span>
  
  <span class="pill kill-chain">da</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">deserialize</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_hostname</span>
  
  <span class="pill kill-chain">dest_ip</span>
  
  <span class="pill kill-chain">dest_ipv6</span>
  
  <span class="pill kill-chain">dest_port</span>
  
  <span class="pill kill-chain">dh</span>
  
  <span class="pill kill-chain">direction</span>
  
  <span class="pill kill-chain">dp</span>
  
  <span class="pill kill-chain">dps</span>
  
  <span class="pill kill-chain">ds</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">fd</span>
  
  <span class="pill kill-chain">fems</span>
  
  <span class="pill kill-chain">fes</span>
  
  <span class="pill kill-chain">fet</span>
  
  <span class="pill kill-chain">field</span>
  
  <span class="pill kill-chain">flow_dns_suffix</span>
  
  <span class="pill kill-chain">flow_end_msec</span>
  
  <span class="pill kill-chain">flow_end_sec</span>
  
  <span class="pill kill-chain">flow_end_time</span>
  
  <span class="pill kill-chain">flow_report_stage</span>
  
  <span class="pill kill-chain">flow_start_msec</span>
  
  <span class="pill kill-chain">flow_start_sec</span>
  
  <span class="pill kill-chain">flow_start_time</span>
  
  <span class="pill kill-chain">flow_version</span>
  
  <span class="pill kill-chain">fsg</span>
  
  <span class="pill kill-chain">fsms</span>
  
  <span class="pill kill-chain">fss</span>
  
  <span class="pill kill-chain">fst</span>
  
  <span class="pill kill-chain">fv</span>
  
  <span class="pill kill-chain">hh</span>
  
  <span class="pill kill-chain">hm</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">ht</span>
  
  <span class="pill kill-chain">http_host</span>
  
  <span class="pill kill-chain">http_method</span>
  
  <span class="pill kill-chain">ibc</span>
  
  <span class="pill kill-chain">iid</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">liuat</span>
  
  <span class="pill kill-chain">liuid</span>
  
  <span class="pill kill-chain">liuida</span>
  
  <span class="pill kill-chain">liuidp</span>
  
  <span class="pill kill-chain">logged_in_user</span>
  
  <span class="pill kill-chain">logged_in_user_account_type</span>
  
  <span class="pill kill-chain">logged_in_user_authority</span>
  
  <span class="pill kill-chain">logged_in_user_principal</span>
  
  <span class="pill kill-chain">mhl</span>
  
  <span class="pill kill-chain">mnl</span>
  
  <span class="pill kill-chain">module_hash_list</span>
  
  <span class="pill kill-chain">module_name_list</span>
  
  <span class="pill kill-chain">obc</span>
  
  <span class="pill kill-chain">pa</span>
  
  <span class="pill kill-chain">paa</span>
  
  <span class="pill kill-chain">pap</span>
  
  <span class="pill kill-chain">parent_process</span>
  
  <span class="pill kill-chain">parent_process_account</span>
  
  <span class="pill kill-chain">parent_process_arguments</span>
  
  <span class="pill kill-chain">parent_process_hash</span>
  
  <span class="pill kill-chain">parent_process_id</span>
  
  <span class="pill kill-chain">parent_process_integrity_level</span>
  
  <span class="pill kill-chain">parent_process_name</span>
  
  <span class="pill kill-chain">parent_process_path</span>
  
  <span class="pill kill-chain">parent_process_user_account_type</span>
  
  <span class="pill kill-chain">parg</span>
  
  <span class="pill kill-chain">ph</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">pil</span>
  
  <span class="pill kill-chain">pn</span>
  
  <span class="pill kill-chain">ppa</span>
  
  <span class="pill kill-chain">pparg</span>
  
  <span class="pill kill-chain">ppath</span>
  
  <span class="pill kill-chain">pph</span>
  
  <span class="pill kill-chain">ppid</span>
  
  <span class="pill kill-chain">ppil</span>
  
  <span class="pill kill-chain">ppn</span>
  
  <span class="pill kill-chain">pppath</span>
  
  <span class="pill kill-chain">ppuat</span>
  
  <span class="pill kill-chain">pr</span>
  
  <span class="pill kill-chain">process</span>
  
  <span class="pill kill-chain">process_account_authority</span>
  
  <span class="pill kill-chain">process_account_principal</span>
  
  <span class="pill kill-chain">process_arguments</span>
  
  <span class="pill kill-chain">process_guid</span>
  
  <span class="pill kill-chain">process_hash</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">process_integrity_level</span>
  
  <span class="pill kill-chain">process_name</span>
  
  <span class="pill kill-chain">process_path</span>
  
  <span class="pill kill-chain">process_user_account_type</span>
  
  <span class="pill kill-chain">protocol_identifier</span>
  
  <span class="pill kill-chain">puat</span>
  
  <span class="pill kill-chain">puid</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">sa</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">sp</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">splunk_server_group</span>
  
  <span class="pill kill-chain">sps</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_interface</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_ipv6</span>
  
  <span class="pill kill-chain">src_port</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">transport</span>
  
  <span class="pill kill-chain">udid</span>
  
  <span class="pill kill-chain">uri_path</span>
  
  <span class="pill kill-chain">user</span>
  
</div>

Example Log

1Jun 26 16:09:18 127.0.0.1 Jun 26 16:09:18 ip-172-31-30-201  fv="nvzFlow_v9" pr="6" sa="172.16.3.110" sp="5203" da="140.82.112.3" dp="443" fd="1" fss="1750954134" fst="Thu Jun 26 16:08:54 2025" fes="1750954134" fet="Thu Jun 26 16:08:54 2025" hh="'" hm="'" ht="'" udid="10E8A7F940225180BFDB748D2AE336EA7285CB8C" liuid="EC2AMAZ-E56LIG5\Administrator" liuida="EC2AMAZ-E56LIG5" liuidp="Administrator" liuat="2" pa="EC2AMAZ-E56LIG5\Administrator" paa="EC2AMAZ-E56LIG5" pap="Administrator" puat="8194" pn="msiexec.exe" ph="23EC37A4DF21893A1B3B6F5F72B2D78918E86C3A90F9664F8248A2C8219F889A" ppa="EC2AMAZ-E56LIG5\Administrator" ppuat="8194" ppn="cmd.exe" pph="41871DADE953D9F40F4AA445FC19982AB59D263C8AA93D7F67A1451663A09A57" ibc="0" obc="0" ds="us-east-2.compute.internal" dh="github.com" iid="4" mnl="'" mhl="'" fsms="1750954134331" fems="1750954134340" pid="8496" ppath="C:\Windows\system32\msiexec.exe" parg=" /i \"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/T1218.007_JScript.msi\"" ppid="9232" pppath="C:\Windows\system32\cmd.exe" aliul="'" pil="12288" ppil="12288" fsg="1" puid="071161F29663831BB4A1C0FADA9805E0"

Required Output Fields

  • dest

Source: GitHub | Version: 2