Name:Cisco NVM - Browser Spawned Unix Shell with External Connection id:6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 version:1 date:None author:Maria Jose Erquiaga, Splunk status:production type:Anomaly Description:Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Data_source:
| stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_hash) as parent_process_hash values(process_hash) as process_hash values(module_name_list) as module_name_list values(module_hash_list) as module_hash_list values(dest_port) as dest_port values(dest_hostname) as dest_hostname
by src src_ip dest dest_ip bytes_in bytes_out user process_id process_name process_path process parent_process_id parent_process_name parent_process_path parent_process
| table firstTime lastTime user parent_process_path parent_process_name parent_process parent_process_hash process_path process_name process process_hash process_id module_name_list module_hash_list src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out
how_to_implement:This search requires Network Visibility Module logs, which includes the flow data sourcetype.
This search uses an input macro named `cisco_network_visibility_module_flowdata`.
We strongly recommend that you specify your environment-specific configurations
(index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
Replace the macro definition with configurations for your Splunk environment.
The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives:Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.
References: -https://attack.mitre.org/tactics/TA0002/ -https://attack.mitre.org/techniques/T1059/ -https://redcanary.com/threat-detection-report/threats/socgholish/ drilldown_searches: name:'View the detection results for - "$src$"' search:'%original_detection_search% | search src="$src$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$src$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Network Visibility Module Analytics']
