Name:Cisco IOS XE Remote Access Probe Burst id:efb20922-17bc-4fb0-880c-be50cfc100dd version:1 date:None author:Nasreddine Bencherchali status:production type:Anomaly Description:This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. The Salt Typhoon notes describe repeated SSH, Telnet-to-port-22, and ping activity across multiple IP addresses in a short time window.
Data_source:
-Cisco IOS Logs
search:`cisco_ios` facility IN ("AAA", "HA_EM") mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG") message_text IN ("*ssh *", "*telnet *", "*ping *") | rex field=message_text "^\w+:(?<aaa_src>[^:@]+)(?:@[^:]*)?:(?<aaa_user>[^:]*):(?<aaa_command>.*?)(?:\s+\((?<aaa_result>SUCCESS|FAILURE)\))?$" | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$" | eval command=lower(trim(coalesce(aaa_command, eem_command, ""))) | where match(command, "^(ssh|telnet|ping)\s+") | rex field=command "(?i)^(?:ssh(?:\s+-l\s+\S+)?|telnet|ping)\s+(?<target_ip>\d{1,3}(?:\.\d{1,3}){3})" | eval command_type=case(match(command, "^ssh\s+"), "ssh", match(command, "^telnet\s+"), "telnet", match(command, "^ping\s+"), "ping") | eval user=coalesce(aaa_user, user, "unknown") | eval src_ip=coalesce(aaa_src, src_ip, "unknown") | eval dest=coalesce(host, dvc, dest, "unknown") | bin _time span=10m | stats count as command_count min(_time) as firstTime max(_time) as lastTime dc(target_ip) as distinct_targets values(target_ip) as target_ips values(command_type) as command_types values(command) as commands by _time dest user src_ip | where command_count >= 8 OR distinct_targets >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_ios_xe_remote_access_probe_burst_filter`
how_to_implement:Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
known_false_positives:Network reachability testing, migration validation, and troubleshooting can generate repeated ping, SSH, or Telnet commands.
References: -https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a -https://blog.talosintelligence.com/salt-typhoon-analysis/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Salt Typhoon']
