GitHub Repo

Analytics Story: Cisco Secure Firewall Threat Defense Analytics

Updated Date: 2026-05-13 ID: b40110f3-6471-46a6-a6f7-4db817f80a86 Author: Nasreddine Bencherchali, Splunk Product: Splunk Enterprise Security

Description

This analytic story provides a suite of detections built to analyze network traffic logs from Cisco Secure Firewall Threat Defense (FTD) appliances. The included analytics focus on uncovering suspicious and potentially malicious behavior such as data exfiltration, encrypted command and control (C2) activity, unauthorized tool downloads, repeated connection attempts to blocked destinations, and traffic involving suspicious SSL certificates or file sharing services. These detections help security teams identify threats that may be missed by traditional rule-based approaches, offering deeper insight into encrypted sessions, protocol misuse, and adversary abuse of legitimate services.

Why it matters

Cisco Secure Firewall Threat Defense is a next-generation firewall platform that provides deep visibility into network activity, including rich telemetry such as connection metadata, application identification, and encrypted traffic analysis through the Encrypted Visibility Engine (EVE). This analytic story leverages that visibility to detect behaviors commonly associated with advanced threats and adversary techniques across multiple ATT&CK tactics, including Command and Control, Exfiltration, Execution, and Discovery.

Cisco Privileged Account Creation with Suspicious SSH Activity

 1| tstats `security_content_summariesonly`
 2  min(_time) as firstTime
 3  max(_time) as lastTime
 4
 5  sum(All_Risk.calculated_risk_score) as risk_score
 6  count(All_Risk.calculated_risk_score) as risk_event_count
 7
 8  values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id
 9  dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count
10
11  values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id
12  dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count
13
14  values(All_Risk.tag) as tag
15  values(source) as source
16  dc(source) as source_count
17
18  values(contributing_events_search)
19
20  values(All_Risk.threat_object)
21
22  from datamodel=Risk.All_Risk where
23
24  source IN (
25    "*Cisco IOS Suspicious Privileged Account Creation*",
26    "*Cisco Secure Firewall - SSH Connection to sshd_operns*",
27    "*Cisco Secure Firewall - SSH Connection to Non-Standard Port*"
28  )
29  by All_Risk.normalized_risk_object
30| `drop_dm_object_name(All_Risk)`
31| eval has_account_creation=if(
32                                match(source, "Cisco IOS Suspicious Privileged Account Creation"),
33                                1, 0
34                              )
35| eval has_ssh_detection=if(
36                              match(source, "SSH Connection to sshd_operns")
37                              OR
38                              match(source, "SSH Connection to Non-Standard Port"),
39                              1, 0
40                            )
41| where has_account_creation=1
42        AND
43        has_ssh_detection=1
44| `security_content_ctime(firstTime)`
45| `security_content_ctime(lastTime)`
46| `cisco_privileged_account_creation_with_suspicious_ssh_activity_filter`

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Cisco Secure Firewall - Connection to File Sharing Domain Web Protocols, External Proxy, Ingress Tool Transfer, Exfiltration to Cloud Storage, Tool Anomaly
Cisco Secure Firewall - Potential Data Exfiltration Exfiltration Over C2 Channel, Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration to Cloud Storage Anomaly
Cisco Secure Firewall - Remote Access Software Usage Traffic Remote Access Tools Anomaly
Cisco Secure Firewall - Possibly Compromised Host Command and Scripting Interpreter, Exploitation for Client Execution, Malware Anomaly
TOR Traffic Multi-hop Proxy TTP
Cisco Secure Firewall - Repeated Malware Downloads Obfuscated Files or Information, Ingress Tool Transfer Anomaly
Cisco Secure Firewall - Oracle E-Business Suite Exploitation Exploit Public-Facing Application TTP
Cisco Secure Firewall - Malware File Downloaded Ingress Tool Transfer, Exploitation for Client Execution Anomaly
Cisco Secure Firewall - Lumma Stealer Download Attempt Exfiltration Over C2 Channel, Asymmetric Cryptography Anomaly
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Command and Scripting Interpreter, Application Layer Protocol, Vulnerability Scanning Anomaly
Cisco Secure Firewall - Rare Snort Rule Triggered Web Services, Phishing for Information Hunting
Internal Horizontal Port Scan NMAP Top 20 Network Service Discovery TTP
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity LSASS Memory, PowerShell, Exploit Public-Facing Application, Exploitation of Remote Services TTP
Cisco Secure Firewall - Oracle E-Business Suite Correlation Exploit Public-Facing Application TTP
Internal Horizontal Port Scan Network Service Discovery TTP
Cisco Secure Firewall - File Download Over Uncommon Port Ingress Tool Transfer, Non-Standard Port Anomaly
Cisco Secure Firewall - Privileged Command Execution via HTTP Command and Scripting Interpreter, Web Shell Anomaly
Detect Outbound LDAP Traffic Command and Scripting Interpreter, Exploit Public-Facing Application Hunting
Cisco Secure Firewall - Bits Network Activity None Anomaly
Cisco Secure Firewall - Wget or Curl Download Cron, Command and Scripting Interpreter, Web Protocols, Ingress Tool Transfer Anomaly
Internal Vertical Port Scan Network Service Discovery TTP
Cisco Secure Firewall - Static Tundra Smart Install Abuse Exploit Public-Facing Application, Exploitation of Remote Services, Endpoint Denial of Service TTP
Cisco Secure Firewall - Lumma Stealer Activity Obfuscated Files or Information, Exploit Public-Facing Application, User Execution, Exploitation of Remote Services TTP
Cisco Secure Firewall - SSH Connection to sshd_operns SSH Anomaly
Detect Outbound SMB Traffic File Transfer Protocols TTP
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Web Protocols, Asymmetric Cryptography, Code Signing Certificates, Digital Certificates TTP
Cisco Secure Firewall - Intrusion Events by Threat Activity Exfiltration Over C2 Channel, Asymmetric Cryptography Anomaly
Cisco Secure Firewall - Binary File Type Download Command and Scripting Interpreter, Exploitation for Client Execution Anomaly
Cisco Secure Firewall - Repeated Blocked Connections Remote System Discovery, Network Service Discovery, Brute Force, Exploitation for Client Execution, Vulnerability Scanning Anomaly
Cisco Secure Firewall - Communication Over Suspicious Ports Remote Services, Process Injection, PowerShell, Ingress Tool Transfer, Remote Access Tools, Non-Standard Port Anomaly
Protocol or Port Mismatch Exfiltration Over Unencrypted Non-C2 Protocol Anomaly
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt Command and Scripting Interpreter, Exploitation for Client Execution TTP
Prohibited Network Traffic Allowed Exfiltration Over Alternative Protocol TTP
Cisco Secure Firewall - Blocked Connection Remote System Discovery, Network Service Discovery, Brute Force, Exploitation for Client Execution, Vulnerability Scanning Anomaly
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt Exfiltration Over C2 Channel, Asymmetric Cryptography Anomaly
Protocols passing authentication in cleartext None Anomaly
Cisco Secure Firewall - SSH Connection to Non-Standard Port SSH Anomaly
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Obfuscated Files or Information, Ingress Tool Transfer Anomaly
Cisco Secure Firewall - High EVE Threat Confidence Exfiltration Over C2 Channel, Web Protocols, Ingress Tool Transfer, Asymmetric Cryptography Anomaly
Cisco Secure Firewall - High Priority Intrusion Classification OS Credential Dumping, Application Layer Protocol, Valid Accounts, Exploit Public-Facing Application, Exploitation for Client Execution TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Cisco Secure Firewall Threat Defense Connection Event Other cisco:sfw:estreamer not_applicable
Cisco Secure Firewall Threat Defense Intrusion Event Other cisco:sfw:estreamer not_applicable
Palo Alto Network Traffic Network icon Network pan:traffic not_applicable
Cisco Secure Firewall Threat Defense File Event Other cisco:sfw:estreamer not_applicable
AWS CloudWatchLogs VPCflow AWS icon AWS aws:cloudwatchlogs:vpcflow aws_cloudwatchlogs_vpcflow
Cisco Secure Access Firewall Other cisco:cloud_security:firewall cisco_secure_access:firewall

References

Source: GitHub | Version: 2