Skip to content

Commit 725b0c3

Browse files
nasbenchnasbench
authored
Salt TTP (#4114)
* first batch * small ci fixes * multiples fixes * more fixes * metadata update * apply review suggestions
1 parent b960f93 commit 725b0c3

10 files changed

Lines changed: 807 additions & 0 deletions

‎detections/application/cisco_ios_xe_guestshell_activation_and_destroy.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Cisco IOS XE Guestshell Activation and Destroy
2+
id: ff82a536-8fde-4963-a801-815826fcdf75
3+
version: 1
4+
creation_date: '2026-05-19'
5+
modification_date: '2026-05-20'
6+
author: Nasreddine Bencherchali
7+
status: production
8+
type: Anomaly
9+
description: |
10+
This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs.
11+
The detection focuses on HA_EM command logging for "guestshell enable" and "guestshell destroy", VMAN activation and destroy messages, and IM/IOX guestshell activation logs observed on some IOS-XE images.
12+
data_source:
13+
- Cisco IOS Logs
14+
search: |-
15+
`cisco_ios`
16+
facility IN ("HA_EM", "VMAN", "IM", "AAA")
17+
mnemonic IN ("LOG", "ACTIVATION_STATE", "IOX_INST_INFO", "INSTALL_STATE", "AAA_ACCOUNTING_MESSAGE")
18+
message_text IN (
19+
"*guestshell enable*",
20+
"*guestshell destroy*",
21+
"*Successfully activated virtual service 'guestshell*",
22+
"*IOX SERVICE guestshell*",
23+
"*Destroying virtual service 'guestshell*",
24+
"*Successfully destroyed virtual service 'guestshell*"
25+
)
26+
| eval dest=coalesce(host, dvc, dest, "unknown")
27+
| eval event_type=case(
28+
like(message_text, "%guestshell enable%"), "guestshell_enable_command",
29+
like(message_text, "%guestshell destroy%"), "guestshell_destroy_command",
30+
like(message_text, "%Successfully activated virtual service 'guestshell%"), "vman_guestshell_activated",
31+
like(message_text, "%IOX SERVICE guestshell%"), "im_iox_guestshell_activated",
32+
like(message_text, "%Destroying virtual service 'guestshell%"), "vman_guestshell_destroying",
33+
like(message_text, "%Successfully destroyed virtual service 'guestshell%"), "vman_guestshell_destroyed",
34+
true(), "other"
35+
)
36+
| bin _time span=30m
37+
| stats count min(_time) as firstTime
38+
max(_time) as lastTime
39+
values(event_type) as event_types
40+
values(message_text) as message
41+
by _time dest
42+
| where
43+
(
44+
mvfind(event_types, "vman_guestshell_activated") >= 0
45+
OR
46+
mvfind(event_types, "im_iox_guestshell_activated") >= 0
47+
OR
48+
mvfind(event_types, "guestshell_enable_command") >= 0
49+
)
50+
AND
51+
(
52+
mvfind(event_types, "vman_guestshell_destroying") >= 0
53+
OR
54+
mvfind(event_types, "vman_guestshell_destroyed") >= 0
55+
OR
56+
mvfind(event_types, "guestshell_destroy_command") >= 0
57+
)
58+
| `security_content_ctime(firstTime)`
59+
| `security_content_ctime(lastTime)`
60+
| `cisco_ios_xe_guestshell_activation_and_destroy_filter`
61+
how_to_implement: |
62+
Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
63+
Enable EEM catchall command logging to capture the "guestshell enable" and "guestshell destroy" commands as HA_EM/LOG events.
64+
known_false_positives: |
65+
No false positives have been identified at this time.
66+
references:
67+
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
68+
- https://blog.talosintelligence.com/salt-typhoon-analysis/
69+
drilldown_searches:
70+
- name: View the detection results for - "$dest$"
71+
search: '%original_detection_search% | search dest = "$dest$"'
72+
earliest_offset: $info_min_time$
73+
latest_offset: $info_max_time$
74+
- name: View risk events for the last 7 days for - "$dest$"
75+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
76+
earliest_offset: 7d
77+
latest_offset: "0"
78+
intermediate_findings:
79+
entities:
80+
- field: dest
81+
type: system
82+
score: 20
83+
message: Cisco IOS-XE device $dest$ had guestshell enabled and destroyed within a short period.
84+
analytic_story:
85+
- Salt Typhoon
86+
asset_type: Network
87+
mitre_attack_id:
88+
- T1059
89+
- T1611
90+
product:
91+
- Splunk Enterprise
92+
- Splunk Enterprise Security
93+
- Splunk Cloud
94+
category: application
95+
security_domain: network
96+
tests:
97+
- name: True Positive Test
98+
attack_data:
99+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco.log
100+
source: ctb:catalyst:syslog
101+
sourcetype: cisco:ios
102+
test_type: unit

‎detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
2+
id: e20a6709-5f2c-4508-83fb-b3af6f705717
3+
version: 1
4+
creation_date: '2026-05-19'
5+
modification_date: '2026-05-20'
6+
author: Nasreddine Bencherchali
7+
status: production
8+
type: Anomaly
9+
description: |
10+
This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period.
11+
It also detects the pattern where a loopback interface is removed before clearing logs and exiting.
12+
data_source:
13+
- Cisco IOS Logs
14+
search: |-
15+
`cisco_ios`
16+
facility IN ("AAA", "HA_EM", "PARSER")
17+
mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG", "CFGLOG_LOGGEDCMD")
18+
message_text IN ("*show logging*", "*clear logging*", "*exit*", "*no interface Loopback*")
19+
20+
| eval cmd=lower(coalesce(command, message_text))
21+
| eval event_type=case(
22+
like(cmd, "%show logging%"), "show_logging",
23+
like(cmd, "%clear logging%"), "clear_logging",
24+
like(cmd, "%exit%"), "exit",
25+
like(cmd, "%no interface loopback%"), "remove_loopback"
26+
)
27+
| where isnotnull(event_type)
28+
| eval dest=coalesce(host, dvc, dest, "unknown")
29+
| bin _time span=2m
30+
| stats count min(_time) as firstTime
31+
max(_time) as lastTime
32+
values(event_type) as event_types
33+
values(message_text) as message_text
34+
values(cmd) as cmd
35+
by _time dest
36+
| where mvfind(event_types, "clear_logging") >= 0
37+
AND
38+
mvfind(event_types, "exit") >= 0
39+
AND
40+
(
41+
mvfind(event_types, "show_logging") >= 0
42+
OR
43+
mvfind(event_types, "remove_loopback") >= 0
44+
)
45+
| `security_content_ctime(firstTime)`
46+
| `security_content_ctime(lastTime)`
47+
| `cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal_filter`
48+
how_to_implement: |
49+
Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
50+
Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
51+
known_false_positives: |
52+
No false positives have been identified at this time.
53+
references:
54+
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
55+
- https://blog.talosintelligence.com/salt-typhoon-analysis/
56+
drilldown_searches:
57+
- name: View the detection results for - "$dest$"
58+
search: '%original_detection_search% | search dest = "$dest$"'
59+
earliest_offset: $info_min_time$
60+
latest_offset: $info_max_time$
61+
- name: View risk events for the last 7 days for - "$dest$"
62+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
63+
earliest_offset: 7d
64+
latest_offset: "0"
65+
intermediate_findings:
66+
entities:
67+
- field: dest
68+
type: system
69+
score: 20
70+
message: Cisco IOS-XE log clearing sequence was observed on $dest$.
71+
threat_objects: []
72+
analytic_story:
73+
- Salt Typhoon
74+
asset_type: Network
75+
mitre_attack_id:
76+
- T1070.001
77+
- T1562
78+
product:
79+
- Splunk Enterprise
80+
- Splunk Enterprise Security
81+
- Splunk Cloud
82+
category: application
83+
security_domain: network
84+
tests:
85+
- name: True Positive Test
86+
attack_data:
87+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco.log
88+
source: ctb:catalyst:syslog
89+
sourcetype: cisco:ios
90+
test_type: unit

‎detections/application/cisco_ios_xe_reconnaissance_command_activity.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Cisco IOS XE Reconnaissance Command Activity
2+
id: 71ac5328-2364-40cf-8381-92b8dc531399
3+
version: 1
4+
creation_date: '2026-05-19'
5+
modification_date: '2026-05-20'
6+
author: Nasreddine Bencherchali
7+
status: production
8+
type: Anomaly
9+
description: |
10+
This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft.
11+
Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths.
12+
This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.
13+
data_source:
14+
- Cisco IOS Logs
15+
search: |-
16+
`cisco_ios`
17+
facility IN ("AAA", "HA_EM")
18+
mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
19+
message_text IN (
20+
"*show running-config*",
21+
"*show tacacs*",
22+
"*show cdp neighbors*",
23+
"*show file systems*",
24+
"*dir bootflash:*",
25+
"*show clock*",
26+
"*show platform software status control-processor brief*",
27+
"*terminal length 0*",
28+
"*terminal width 0*"
29+
)
30+
31+
| rex field=message_text "^\w+:(?<aaa_src>[^:@]+)(?:@[^:]*)?:(?<aaa_user>[^:]*):(?<aaa_command>.*?)(?:\s+\((?<aaa_result>SUCCESS|FAILURE)\))?$"
32+
| rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
33+
| eval command=lower(trim(coalesce(aaa_command, eem_command, "")))
34+
35+
| eval command_type=case(
36+
like(command, "show running-config%"), "show_conf",
37+
like(command, "show tacacs%"), "show_tacacs",
38+
like(command, "show cdp neighbors detail%"), "show_cdp",
39+
like(command, "show cdp neighbors%"), "show_cdp",
40+
like(command, "show file systems%"), "show_file",
41+
like(command, "dir bootflash:%"), "dir_bootflash",
42+
like(command, "show clock%"), "show_clock",
43+
like(command, "show platform software status control-processor brief%"), "show_platform",
44+
like(command, "terminal length 0%"), "terminal",
45+
like(command, "terminal width 0%"), "terminal",
46+
true(), null())
47+
| where isnotnull(command_type)
48+
| eval user=coalesce(aaa_user, user, "unknown")
49+
| eval src_ip=coalesce(aaa_src, src_ip, "unknown")
50+
| eval dest=coalesce(host, dvc, dest, "unknown")
51+
| bin _time span=5m
52+
| stats count min(_time) as firstTime
53+
max(_time) as lastTime
54+
dc(command_type) as unique_recon_commands
55+
values(command_type) as command_types
56+
values(command) as commands
57+
by _time dest user src_ip
58+
| where unique_recon_commands >= 4
59+
| `security_content_ctime(firstTime)`
60+
| `security_content_ctime(lastTime)`
61+
| `cisco_ios_xe_reconnaissance_command_activity_filter`
62+
how_to_implement: |
63+
Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
64+
On Nexus, local accounting can emit "%AAA-6-AAA_ACCOUNTING_MESSAGE".
65+
On Catalyst, use TACACS+ command accounting or EEM catchall syslog for exec command visibility.
66+
known_false_positives: |
67+
Network audits and troubleshooting can produce similar command bursts. Tune the command list, threshold, and approved administrators for the environment.
68+
references:
69+
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
70+
- https://blog.talosintelligence.com/salt-typhoon-analysis/
71+
drilldown_searches:
72+
- name: View the detection results for - "$dest$"
73+
search: '%original_detection_search% | search dest = "$dest$"'
74+
earliest_offset: $info_min_time$
75+
latest_offset: $info_max_time$
76+
- name: View risk events for the last 7 days for - "$dest$"
77+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
78+
earliest_offset: 7d
79+
latest_offset: "0"
80+
intermediate_findings:
81+
entities:
82+
- field: dest
83+
type: system
84+
score: 20
85+
message: User $user$ executed $unique_recon_commands$ Cisco reconnaissance command categories on $dest$.
86+
threat_objects:
87+
- field: commands
88+
type: command
89+
analytic_story:
90+
- Salt Typhoon
91+
asset_type: Network
92+
mitre_attack_id:
93+
- T1082
94+
- T1016
95+
- T1590
96+
product:
97+
- Splunk Enterprise
98+
- Splunk Enterprise Security
99+
- Splunk Cloud
100+
category: application
101+
security_domain: network
102+
tests:
103+
- name: True Positive Test
104+
attack_data:
105+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco.log
106+
source: ctb:nexus:syslog
107+
sourcetype: cisco:ios
108+
test_type: unit

‎detections/application/cisco_ios_xe_remote_access_probe_burst.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Cisco IOS XE Remote Access Probe Burst
2+
id: efb20922-17bc-4fb0-880c-be50cfc100dd
3+
version: 1
4+
creation_date: '2026-05-19'
5+
modification_date: '2026-05-20'
6+
author: Nasreddine Bencherchali
7+
status: production
8+
type: Anomaly
9+
description: |
10+
This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. The Salt Typhoon notes describe repeated SSH, Telnet-to-port-22, and ping activity across multiple IP addresses in a short time window.
11+
data_source:
12+
- Cisco IOS Logs
13+
search: |-
14+
`cisco_ios`
15+
facility IN ("AAA", "HA_EM")
16+
mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
17+
message_text IN ("*ssh *", "*telnet *", "*ping *")
18+
| rex field=message_text "^\w+:(?<aaa_src>[^:@]+)(?:@[^:]*)?:(?<aaa_user>[^:]*):(?<aaa_command>.*?)(?:\s+\((?<aaa_result>SUCCESS|FAILURE)\))?$"
19+
| rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
20+
| eval command=lower(trim(coalesce(aaa_command, eem_command, "")))
21+
| where match(command, "^(ssh|telnet|ping)\s+")
22+
| rex field=command "(?i)^(?:ssh(?:\s+-l\s+\S+)?|telnet|ping)\s+(?<target_ip>\d{1,3}(?:\.\d{1,3}){3})"
23+
| eval command_type=case(match(command, "^ssh\s+"), "ssh", match(command, "^telnet\s+"), "telnet", match(command, "^ping\s+"), "ping")
24+
| eval user=coalesce(aaa_user, user, "unknown")
25+
| eval src_ip=coalesce(aaa_src, src_ip, "unknown")
26+
| eval dest=coalesce(host, dvc, dest, "unknown")
27+
| bin _time span=10m
28+
| stats count as command_count
29+
min(_time) as firstTime
30+
max(_time) as lastTime
31+
dc(target_ip) as distinct_targets
32+
values(target_ip) as target_ips
33+
values(command_type) as command_types
34+
values(command) as commands
35+
by _time dest user src_ip
36+
| where command_count >= 8 OR distinct_targets >= 5
37+
| `security_content_ctime(firstTime)`
38+
| `security_content_ctime(lastTime)`
39+
| `cisco_ios_xe_remote_access_probe_burst_filter`
40+
how_to_implement: |
41+
Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
42+
Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
43+
known_false_positives: |
44+
Network reachability testing, migration validation, and troubleshooting can generate repeated ping, SSH, or Telnet commands.
45+
references:
46+
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
47+
- https://blog.talosintelligence.com/salt-typhoon-analysis/
48+
drilldown_searches:
49+
- name: View the detection results for - "$dest$"
50+
search: '%original_detection_search% | search dest = "$dest$"'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
- name: View risk events for the last 7 days for - "$dest$"
54+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
55+
earliest_offset: 7d
56+
latest_offset: "0"
57+
intermediate_findings:
58+
entities:
59+
- field: dest
60+
type: system
61+
score: 20
62+
message: User $user$ issued $command_count$ ping, SSH, or Telnet commands from Cisco device $dest$ across $distinct_targets$ targets.
63+
threat_objects:
64+
- field: target_ips
65+
type: ip_address
66+
- field: commands
67+
type: command
68+
analytic_story:
69+
- Salt Typhoon
70+
asset_type: Network
71+
mitre_attack_id:
72+
- T1018
73+
- T1021.004
74+
- T1046
75+
product:
76+
- Splunk Enterprise
77+
- Splunk Enterprise Security
78+
- Splunk Cloud
79+
category: application
80+
security_domain: network
81+
tests:
82+
- name: True Positive Test
83+
attack_data:
84+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco.log
85+
source: ctb:nexus:syslog
86+
sourcetype: cisco:ios
87+
test_type: unit

0 commit comments

Comments
 (0)