fixes and updates

Author: nasbench

detections/application/cisco_asa___aaa_policy_tampering.yml

@@ -23,7 +23,7 @@ search: |
       "no aaa*"
   )
   | fillnull
-  | stats count 
+  | stats count
           earliest(_time) as firstTime
           latest(_time) as lastTime
           values(user) as user
@@ -41,6 +41,7 @@ how_to_implement: |
   To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
   If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
   You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
+  You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
 known_false_positives: |
   Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified against investigated.
   Consider filtering modifications performed where necessary.

detections/application/cisco_asa___core_syslog_message_volume_drop.yml

@@ -19,30 +19,31 @@ search: |
     message_id="710005","TCP request discarded"
   )
   | bin _time span=15m
-  | stats count values(msg_desc) as message_description 
-                values(dest) as dest 
+  | stats count values(msg_desc) as message_description
+                values(dest) as dest
     by _time message_id
   | xyseries _time message_id count
   | `cisco_asa___core_syslog_message_volume_drop_filter`
 how_to_implement: |
   This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
   This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
   The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
+  You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
 known_false_positives: |
-  Planned maintenance, network outages, routing changes, or benign configuration
-  updates may reduce log volume temporarily. Validate against change management
-  records and corroborate with device health metrics.
+  Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
+  Validate against change management records and corroborate with device health metrics.
 references:
-- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/  
-- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks 
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
-- https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
-- https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
+  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
+  - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
+  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
+  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
+  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
+  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
+  - https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
+  - https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
 tags:
   analytic_story:
+    - Suspicious Cisco Adaptive Security Appliance Activity
     - ArcaneDoor
   asset_type: Network
   mitre_attack_id:

detections/application/cisco_asa___device_file_copy_activity.yml

@@ -7,8 +7,8 @@ status: production
 type: Anomaly
 description: |
   This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
-  Adversaries may copy device files including configurations, logs, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
-  The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, or other system files from disk0:, flash:, or system: locations.
+  Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
+  The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations.
   Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.
 data_source:
   - Cisco ASA Logs
@@ -19,9 +19,10 @@ search: |
   command IN (
       "*running-config*",
       "*startup-config*",
-      "copy system:*",
+      "/pcap capture:*",
       "copy disk0:*",
-      "copy flash:*"
+      "copy flash:*",
+      "copy system:*"
   )
   | fillnull
   | stats earliest(_time) as firstTime
@@ -41,30 +42,22 @@ how_to_implement: |
   To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
   If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
   You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
+  You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
 known_false_positives: |
-  Legitimate configuration exports may occur during normal administrative activities
-  such as scheduled automated backups, pre-change configuration snapshots as part of
-  change management procedures, disaster recovery preparations, configuration audits,
-  or troubleshooting activities. These events should be verified against backup schedules,
-  change management tickets, disaster recovery plans, or established configuration
-  management procedures. Consider filtering exports performed during approved maintenance
-  windows, by known administrative or backup accounts with proper authorization, to
-  known backup server destinations, or exports that align with documented backup policies.
+  Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.
 references:
-- https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/c1-commands.html
-- https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S/sa-shov-commands.html
-- https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200657-Configure-Backup-and-Restore-on-ASA.html
+  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
 drilldown_searches:
-- name: View the detection results for $host$
-  search: '%original_detection_search% | search  host = $host$'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for $host$
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
+  - name: View the detection results for $host$
+    search: '%original_detection_search% | search  host = $host$'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for $host$
+    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 rba:
-  message: User $user$ executed command to export device configuration from Cisco ASA host $host$.
+  message: User $user$ executed command $command$ to export device configuration from Cisco ASA host $host$.
   risk_objects:
     - field: host
       type: system
@@ -77,6 +70,7 @@ rba:
 tags:
   analytic_story:
     - Suspicious Cisco Adaptive Security Appliance Activity
+    - ArcaneDoor
   asset_type: Network
   mitre_attack_id:
     - T1005

detections/application/cisco_asa___device_file_copy_to_remote_location.yml

@@ -4,12 +4,13 @@ version: 1
 date: '2025-11-18'
 author: Nasreddine Bencherchali, Splunk
 status: production
-type: TTP
+type: Anomaly
 description: |
   This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM.
-  Adversaries may exfiltrate device files including configurations, logs, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure.
+  Adversaries may exfiltrate device files including configurations, logs, packet captures, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure.
   The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands with remote protocol indicators (tftp:, ftp:, http:, https:, smb:, scp:).
   Investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows.
+  We recommend adapting the detection filters to exclude known legitimate backup activities.
 data_source:
   - Cisco ASA Logs
 search: |
@@ -19,9 +20,10 @@ search: |
   command IN (
       "*running-config*",
       "*startup-config*",
-      "copy system:*",
+      "/pcap capture:*",
       "copy disk0:*",
-      "copy flash:*"
+      "copy flash:*",
+      "copy system:*"
   )
   command IN (
       "*ftp:*",
@@ -30,7 +32,7 @@ search: |
       "*smb:*",
       "*scp:*"
   )
-  
+
   | eval remote_protocol = mvappend(
     if(match(command, "tftp:"), "TFTP", null()),
     if(match(command, "ftp:"), "FTP", null()),
@@ -59,11 +61,13 @@ how_to_implement: |
   To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message IDs 111008 and 111010.
   If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and add message IDs 111008 and 111010.
   You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
+  You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
 known_false_positives: |
-  Legitimate configuration exports to remote locations may occur during normal administrative
-  activities. Investigate these events to verify their legitimacy and apply necessary filters.
+  Legitimate configuration exports to remote locations may occur during normal administrative activities.
+  Investigate these events to verify their legitimacy and apply necessary filters.
 references:
-- https://community.cisco.com/t5/security-knowledge-base/asa-how-to-download-images-using-tftp-ftp-http-https-and-scp/ta-p/3109769
+  - https://community.cisco.com/t5/security-knowledge-base/asa-how-to-download-images-using-tftp-ftp-http-https-and-scp/ta-p/3109769
+  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
 drilldown_searches:
   - name: View the detection results for $host$
     search: '%original_detection_search% | search  host = $host$'
@@ -90,6 +94,7 @@ rba:
 tags:
   analytic_story:
     - Suspicious Cisco Adaptive Security Appliance Activity
+    - ArcaneDoor
   asset_type: Network
   mitre_attack_id:
     - T1005

detections/application/cisco_asa___logging_disabled_via_cli.yml

@@ -17,14 +17,14 @@ data_source:
   - Cisco ASA Logs
 search: |
   `cisco_asa`
-  message_id IN (111008, 111010) 
+  message_id IN (111008, 111010)
   command IN (
       "*no logging*",
       "*logging disable*",
       "*clear logging*",
       "*no logging host*",
       "*no logging trap*"
-  ) 
+  )
   | stats earliest(_time) as firstTime
           latest(_time) as lastTime
           values(user) as user
@@ -33,19 +33,19 @@ search: |
           values(command) as command
           values(src_ip) as src_ip
           values(process_name) as process_name
-    by host 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`  
+    by host
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `cisco_asa___logging_disabled_via_cli_filter`
 how_to_implement: |
   This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
   To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
   If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
   You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
+  You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
 known_false_positives: |
-  Administrators may intentionally disable or modify logging during maintenance,
-  troubleshooting, or device reconfiguration. These events should be verified
-  against approved change management activities.
+  Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration.
+  These events should be verified against approved change management activities.
 references:
   - https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
   - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks