Name:Cisco IOS XE Tunnel Interface Configuration id:8654314d-8e4d-4971-9f35-b9d477bf668e version:1 date:None author:Nasreddine Bencherchali status:production type:Anomaly Description:This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. The Salt Typhoon notes identify this tunnel configuration pattern as suspicious.
Data_source:
-Cisco IOS Logs
search:`cisco_ios` facility IN ("HA_EM", "PARSER") mnemonic IN ("LOG", "CFGLOG_LOGGEDCMD") message_text IN ("*interface Tunnel*", "*tunnel source*", "*tunnel destination*", "*ip address 10.10.12.*") | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$" | rex field=message_text "<enteredCommand><cli>(?<parser_command>.*?)</cli>" | rex field=message_text "<user>(?<parser_user>[^<]+)</user>" | rex field=message_text "<srcIP>(?<parser_src_ip>[^<]+)</srcIP>" | eval command=lower(trim(coalesce(parser_command, eem_command, ""))) | eval event_type=case( match(command, "^interface\s+tunnel"), "interface_tunnel", match(command, "^tunnel\s+source"), "tunnel_source", match(command, "^tunnel\s+destination"), "tunnel_destination", match(command, "^ip\s+address\s+10\.10\.12\."), "tunnel_ip_address", true(), null()) | where isnotnull(event_type) | eval user=coalesce(parser_user, user, "unknown") | eval src_ip=coalesce(parser_src_ip, src_ip, "unknown") | eval dest=coalesce(host, dvc, dest, "unknown") | bin _time span=15m | stats count min(_time) as firstTime max(_time) as lastTime values(event_type) as event_types values(user) as user values(src_ip) as src_ip values(command) as commands by _time dest | where mvfind(event_types, "interface_tunnel") >= 0 AND mvfind(event_types, "tunnel_source") >= 0 AND mvfind(event_types, "tunnel_destination") >= 0 AND mvfind(event_types, "tunnel_ip_address") >= 0 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_ios_xe_tunnel_interface_configuration_filter`
how_to_implement:Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
known_false_positives:No false positives have been identified at this time.
References: -https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a -https://blog.talosintelligence.com/salt-typhoon-analysis/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Salt Typhoon']
