Skip to content

Commit 515d736

Browse files
Add New ASA Analytics (#3794)
* first batch * more updates * update tags and filter * more fixes * Update cisco_asa___reconnaissance_command_activity.yml * Update cisco_asa___reconnaissance_command_activity.yml * Update cisco_asa___reconnaissance_command_activity.yml * Update cisco_asa___reconnaissance_command_activity.yml * update to production * fixes and updates * update date and fix typos * apply suggestion * Update cisco_asa___reconnaissance_command_activity.yml * add explicit message ids --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
1 parent 888c224 commit 515d736

19 files changed

+1079
-80
lines changed

data_sources/cisco_asa_logs.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA Logs
22
id: 3f2a9b6d-1c8e-4f7b-a2d3-8b7f1c2a9d4e
3-
version: 1
4-
date: '2025-09-23'
3+
version: 2
4+
date: '2025-10-27'
55
author: Bhavin Patel, Splunk
66
description: "Data source object for Cisco ASA system logs. Cisco ASA logs provide\
77
\ firewall operational and security telemetry (connection events, ACL denies, VPN\
@@ -15,7 +15,7 @@ description: "Data source object for Cisco ASA system logs. Cisco ASA logs provi
1515
\ enabled, as it relies on the presence of specific message IDs. You can find specific\
1616
\ instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.\
1717
\ \n"
18-
source: cisco:asa
18+
source: not_applicable
1919
sourcetype: cisco:asa
2020
separator: null
2121
supported_TA:
Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Cisco ASA - AAA Policy Tampering
2+
id: 8f2c4e9a-5d3b-4c7e-9a1f-6e8d5b2c3a9f
3+
version: 1
4+
date: '2025-11-18'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects modifications to authentication and authorization (AAA) security policies on Cisco ASA devices via CLI or ASDM.
10+
AAA policies control critical security mechanisms including authentication attempts, lockout thresholds, password policies, and access control settings that protect administrative access to network infrastructure.
11+
Adversaries or malicious insiders may weaken authentication policies to facilitate brute force attacks, disable account lockouts to enable unlimited password attempts, reduce password complexity requirements, or modify authorization settings to elevate privileges and maintain persistent access.
12+
The detection monitors for command execution events containing AAA-related commands such as `aaa authentication`, `aaa authorization`, or `aaa local authentication`, focusing on changes to authentication attempts, lockout policies, and access control configurations.
13+
Investigate any unauthorized modifications to AAA policies, especially changes that weaken security posture (increasing max-fail attempts, disabling lockouts, reducing password requirements), and verify these changes against approved change management processes and security policies.
14+
data_source:
15+
- Cisco ASA Logs
16+
search: |
17+
`cisco_asa`
18+
message_id IN (111008, 111010)
19+
command IN (
20+
"aaa authentication*",
21+
"aaa authorization*",
22+
"aaa local authentication*",
23+
"aaa-server*",
24+
"no aaa*"
25+
)
26+
| fillnull
27+
| stats count
28+
earliest(_time) as firstTime
29+
latest(_time) as lastTime
30+
values(user) as user
31+
values(action) as action
32+
values(message_id) as message_id
33+
values(command) as command
34+
values(src_ip) as src_ip
35+
values(process_name) as process_name
36+
by host
37+
| `security_content_ctime(firstTime)`
38+
| `security_content_ctime(lastTime)`
39+
| `cisco_asa___aaa_policy_tampering_filter`
40+
how_to_implement: |
41+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
42+
To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
43+
If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
44+
You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
45+
You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
46+
known_false_positives: |
47+
Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified and investigated. Consider filtering modifications performed by known administrative accounts where necessary.
48+
references:
49+
- https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html
50+
drilldown_searches:
51+
- name: View the detection results for $host$
52+
search: '%original_detection_search% | search host = $host$'
53+
earliest_offset: $info_min_time$
54+
latest_offset: $info_max_time$
55+
- name: View risk events for the last 7 days for $host$
56+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57+
earliest_offset: $info_min_time$
58+
latest_offset: $info_max_time$
59+
rba:
60+
message: User $user$ executed command $command$ to modify AAA configuration on Cisco ASA host $host$.
61+
risk_objects:
62+
- field: host
63+
type: system
64+
score: 40
65+
threat_objects:
66+
- field: command
67+
type: process
68+
tags:
69+
analytic_story:
70+
- Suspicious Cisco Adaptive Security Appliance Activity
71+
asset_type: Network
72+
mitre_attack_id:
73+
- T1556.004
74+
product:
75+
- Splunk Enterprise
76+
- Splunk Enterprise Security
77+
security_domain: network
78+
tests:
79+
- name: True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/generic/cisco_asa_generic_logs.log
82+
source: not_applicable
83+
sourcetype: cisco:asa
Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Core Syslog Message Volume Drop
22
id: 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
3-
version: 2
4-
date: '2025-09-25'
3+
version: 3
4+
date: '2025-10-13'
55
author: Bhavin Patel, Micheal Haag, Splunk
66
status: production
77
type: Hunting
@@ -11,35 +11,39 @@ data_source:
1111
- Cisco ASA Logs
1212
search: |
1313
`cisco_asa`
14-
| rex "%ASA-[^-]+-\d+-(?<message_id>\d+):"
15-
| search message_id IN (302013,302014,609002,710005)
14+
message_id IN (302013, 302014, 609002, 710005)
1615
| eval msg_desc=case(
1716
message_id="302013","Built inbound TCP connection",
1817
message_id="302014","Teardown TCP connection",
1918
message_id="609002","Teardown local-host management",
2019
message_id="710005","TCP request discarded"
2120
)
2221
| bin _time span=15m
23-
| stats count values(msg_desc) as message_description values(host) as host by _time message_id
22+
| stats count values(msg_desc) as message_description
23+
values(dest) as dest
24+
by _time message_id
2425
| xyseries _time message_id count
2526
| `cisco_asa___core_syslog_message_volume_drop_filter`
2627
how_to_implement: |
27-
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880. The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
28+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
29+
This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
30+
The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
31+
You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
2832
known_false_positives: |
29-
Planned maintenance, network outages, routing changes, or benign configuration
30-
updates may reduce log volume temporarily. Validate against change management
31-
records and corroborate with device health metrics.
33+
Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
34+
Validate against change management records and corroborate with device health metrics.
3235
references:
33-
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
34-
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
35-
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
36-
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
37-
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
38-
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
39-
- https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
40-
- https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
36+
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
37+
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
38+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
39+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
40+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
41+
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
42+
- https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
43+
- https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
4144
tags:
4245
analytic_story:
46+
- Suspicious Cisco Adaptive Security Appliance Activity
4347
- ArcaneDoor
4448
asset_type: Network
4549
mitre_attack_id:
@@ -56,5 +60,5 @@ tests:
5660
- name: True Positive Test
5761
attack_data:
5862
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/arcane_door/cisco_asa.log
59-
source: syslog
63+
source: not_applicable
6064
sourcetype: cisco:asa
Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Cisco ASA - Device File Copy Activity
2+
id: 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
3+
version: 1
4+
date: '2025-11-18'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
10+
Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
11+
The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations.
12+
Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.
13+
data_source:
14+
- Cisco ASA Logs
15+
search: |
16+
`cisco_asa`
17+
message_id IN (111008, 111010)
18+
command = "copy *"
19+
command IN (
20+
"*running-config*",
21+
"*startup-config*",
22+
"*/pcap capture:*",
23+
"* disk0:*",
24+
"* flash:*",
25+
"* system:*"
26+
)
27+
| fillnull
28+
| stats earliest(_time) as firstTime
29+
latest(_time) as lastTime
30+
values(user) as user
31+
values(action) as action
32+
values(message_id) as message_id
33+
values(command) as command
34+
values(src_ip) as src_ip
35+
values(process_name) as process_name
36+
by host
37+
| `security_content_ctime(firstTime)`
38+
| `security_content_ctime(lastTime)`
39+
| `cisco_asa___device_file_copy_activity_filter`
40+
how_to_implement: |
41+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
42+
To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
43+
If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
44+
You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
45+
You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
46+
known_false_positives: |
47+
Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.
48+
references:
49+
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
50+
drilldown_searches:
51+
- name: View the detection results for $host$
52+
search: '%original_detection_search% | search host = $host$'
53+
earliest_offset: $info_min_time$
54+
latest_offset: $info_max_time$
55+
- name: View risk events for the last 7 days for $host$
56+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57+
earliest_offset: $info_min_time$
58+
latest_offset: $info_max_time$
59+
rba:
60+
message: User $user$ executed command $command$ to export device configuration from Cisco ASA host $host$.
61+
risk_objects:
62+
- field: host
63+
type: system
64+
score: 50
65+
threat_objects:
66+
- field: src_ip
67+
type: ip_address
68+
- field: command
69+
type: process
70+
tags:
71+
analytic_story:
72+
- Suspicious Cisco Adaptive Security Appliance Activity
73+
- ArcaneDoor
74+
asset_type: Network
75+
mitre_attack_id:
76+
- T1005
77+
- T1530
78+
product:
79+
- Splunk Enterprise
80+
- Splunk Enterprise Security
81+
security_domain: network
82+
tests:
83+
- name: True Positive Test
84+
attack_data:
85+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/generic/cisco_asa_generic_logs.log
86+
source: not_applicable
87+
sourcetype: cisco:asa

0 commit comments

Comments
 (0)