Sample rules
Detect Remote Access Software Usage Traffic
- source: splunk
- technicques:
Description
The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
values(All_Traffic.dest_port) as dest_port
latest(All_Traffic.user) as user
FROM datamodel=Network_Traffic WHERE
[
| inputlookup remote_access_software
| search match_pattern!=""
| rename match_pattern as All_Traffic.app
| table All_Traffic.app
]
BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip
All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user
All_Traffic.vendor_product
| `drop_dm_object_name("All_Traffic")`
| lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_traffic_filter`
Detect Remote Access Software Usage DNS
- source: splunk
- technicques:
Description
The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Network_Resolution WHERE
[
| inputlookup remote_access_software
| search domain!=""
| rename domain as DNS.query
| table DNS.query
]
BY DNS.answer DNS.answer_count DNS.query
DNS.query_count DNS.reply_code_id DNS.src
DNS.vendor_product
| `drop_dm_object_name("DNS")`
| lookup local=t remote_access_software domain AS query OUTPUT app as signature, category, reference, description
| eval dest = query
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_dns_filter`
Detect Remote Access Software Usage URL
- source: splunk
- technicques:
Description
The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
latest(Web.http_method) as http_method
latest(Web.http_user_agent) as http_user_agent
latest(Web.url) as url
latest(Web.user) as user
latest(Web.dest) as dest
FROM datamodel=Web WHERE
Web.url_domain=*
NOT Web.url_domain IN (
"-",
"unknown"
)
[
| inputlookup remote_access_software
| search domain!=""
| rename domain as Web.url_domain
| table Web.url_domain
]
BY Web.action Web.src Web.category
Web.url_domain Web.url_length
| `drop_dm_object_name("Web")`
| lookup local=t remote_access_software domain AS url_domain OUTPUT app as signature, category, reference, description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_url_filter`
Detect Remote Access Software Usage Process
- source: splunk
- technicques:
Description
The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
values(Processes.parent_process) as parent_process
FROM datamodel=Endpoint.Processes WHERE
[
| inputlookup remote_access_software
| search file_name!=""
| rename file_name as Processes.process_name
| table Processes.process_name
]
Processes.dest!="unknown"
Processes.user!="unknown"
BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| lookup local=t remote_access_software file_name AS process_name OUTPUT app as signature, category, reference, description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_process_filter`
Cisco Secure Firewall - Remote Access Software Usage Traffic
- source: splunk
- technicques:
Description
The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event.
Detection logic
`cisco_secure_firewall`
EventType=ConnectionEvent
[
| inputlookup remote_access_software
| search match_pattern!=""
| rename match_pattern as ClientApplication
| table ClientApplication
]
| stats count min(_time) as firstTime
max(_time) as lastTime
values(dest_port) as dest_port
values(dest) as dest
values(transport) as transport
values(url) as url
values(rule) as rule
by src ClientApplication action
| lookup local=t remote_access_software match_pattern AS ClientApplication OUTPUT app as signature, category, reference, description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `cisco_secure_firewall___remote_access_software_usage_traffic_filter`