Skip to content

Commit d8ddca1

Browse files
authored
Merge branch 'develop' into fix_cwd_path_detections
2 parents 8cff5c0 + 064cbae commit d8ddca1

11 files changed

+63
-62
lines changed

contentctl.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ apps:
4444
- uid: 7404
4545
title: Cisco Security Cloud
4646
appid: CiscoSecurityCloud
47-
version: 3.4.2
47+
version: 3.5.1
4848
description: description of app
49-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_342.tgz
49+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_351.tgz
5050
- uid: 6652
5151
title: Add-on for Linux Sysmon
5252
appid: Splunk_TA_linux_sysmon
@@ -254,4 +254,4 @@ apps:
254254
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
255255
test_data_caches:
256256
- base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/
257-
base_directory_name: external_repos/attack_data
257+
base_directory_name: external_repos/attack_data

data_sources/cisco_ai_defense_alerts.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields: null

data_sources/cisco_asa_logs.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ separator: null
2121
supported_TA:
2222
- name: Cisco Security Cloud
2323
url: https://splunkbase.splunk.com/app/7404
24-
version: 3.4.2
24+
version: 3.5.1
2525
fields:
2626
- Cisco_ASA_action
2727
- Cisco_ASA_message_id

data_sources/cisco_duo_activity.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields:
1515
- access_device.browser
1616
- access_device.browser_version

data_sources/cisco_duo_administrator.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields:
1515
- action
1616
- actionlabel

data_sources/cisco_secure_firewall_threat_defense_connection_event.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields:
1515
- AC_RuleAction
1616
- action

data_sources/cisco_secure_firewall_threat_defense_file_event.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields:
1515
- app
1616
- Application

data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.2
13+
version: 3.5.1
1414
fields:
1515
- Application
1616
- Classification

detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure AD High Number Of Failed Authentications For User
22
id: 630b1694-210a-48ee-a450-6f79e7679f2c
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-12-01'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -15,23 +15,26 @@ description: The following analytic identifies an Azure AD account experiencing
1515
based on their specific environment to reduce false positives.
1616
data_source:
1717
- Azure Active Directory
18-
search: '`azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
19-
| rename properties.* as *
20-
| bucket span=10m _time
21-
| rename properties.userAgent as user_agent
22-
| fillnull
23-
| stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(src) as src values(user_agent) as user_agent by user _time vendor_account vendor_product
24-
| where count > 20
25-
| `security_content_ctime(firstTime)`
26-
| `security_content_ctime(lastTime)`
27-
| `azure_ad_high_number_of_failed_authentications_for_user_filter`'
18+
search: |
19+
`azure_monitor_aad`
20+
category=SignInLogs
21+
properties.status.errorCode=50126
22+
properties.authenticationDetails{}.succeeded=false
23+
| rename properties.* as *
24+
| bin span=10m _time
25+
| fillnull value=null
26+
| stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(src) as src values(user_agent) as user_agent by user _time vendor_account vendor_product
27+
| where count > 20
28+
| `security_content_ctime(firstTime)`
29+
| `security_content_ctime(lastTime)`
30+
| `azure_ad_high_number_of_failed_authentications_for_user_filter`
2831
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2932
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
3033
You must be ingesting Azure Active Directory events into your Splunk environment
3134
through an EventHub. This analytic was written to be used with the azure:monitor:aad
3235
sourcetype leveraging the SignInLogs log category.
3336
known_false_positives: A user with more than 20 failed authentication attempts in
34-
the span of 5 minutes may also be triggered by a broken application.
37+
the span of 10 minutes may also be triggered by a broken application.
3538
references:
3639
- https://attack.mitre.org/techniques/T1110/
3740
- https://attack.mitre.org/techniques/T1110/001/
@@ -50,8 +53,7 @@ drilldown_searches:
5053
earliest_offset: $info_min_time$
5154
latest_offset: $info_max_time$
5255
rba:
53-
message: User $user$ failed to authenticate more than 20 times in the span of 5
54-
minutes.
56+
message: User $user$ failed to authenticate more than 20 times in the span of 10 minutes.
5557
risk_objects:
5658
- field: user
5759
type: user
@@ -72,7 +74,7 @@ tags:
7274
tests:
7375
- name: True Positive Test
7476
attack_data:
75-
- data:
77+
- data:
7678
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
7779
source: Azure AD
7880
sourcetype: azure:monitor:aad

detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Azure AD High Number Of Failed Authentications From Ip
22
id: e5ab41bf-745d-4f72-a393-2611151afd8e
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-12-01'
55
author: Mauricio Velazco, Bhavin Patel, Splunk
66
status: production
77
type: TTP
@@ -14,13 +14,19 @@ description: The following analytic detects an IP address with 20 or more failed
1414
within the Azure environment.
1515
data_source:
1616
- Azure Active Directory
17-
search: '`azure_monitor_aad` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
18-
| rename properties.* as *
19-
| bucket span=10m _time
20-
| rename properties.userAgent as user_agent
21-
| fillnull
22-
| stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(user) as user values(user_agent) as user_agent by src _time vendor_account vendor_product
23-
| where count > 20 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
17+
search: |
18+
`azure_monitor_aad`
19+
category=SignInLogs
20+
properties.status.errorCode=50126
21+
properties.authenticationDetails{}.succeeded=false
22+
| rename properties.* as *
23+
| bin span=10m _time
24+
| fillnull value=null
25+
| stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(user) as user values(user_agent) as user_agent by src _time vendor_account vendor_product
26+
| where count > 20
27+
| `security_content_ctime(firstTime)`
28+
| `security_content_ctime(lastTime)`
29+
| `azure_ad_high_number_of_failed_authentications_from_ip_filter`
2430
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
2531
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
2632
You must be ingesting Azure Active Directory events into your Splunk environment
@@ -47,8 +53,7 @@ drilldown_searches:
4753
earliest_offset: $info_min_time$
4854
latest_offset: $info_max_time$
4955
rba:
50-
message: $src$ failed to authenticate more than 20 times in the span of 10 minutes
51-
minutes.
56+
message: $src$ failed to authenticate more than 20 times in the span of 10 minutes.
5257
risk_objects:
5358
- field: user
5459
type: user
@@ -73,7 +78,7 @@ tags:
7378
tests:
7479
- name: True Positive Test
7580
attack_data:
76-
- data:
81+
- data:
7782
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
7883
source: Azure AD
7984
sourcetype: azure:monitor:aad

0 commit comments

Comments
 (0)