Name:Cisco Privileged Account Creation with Suspicious SSH Activity id:7f8e2b4c-9a3d-4e1f-8c5b-6d7e8f9a0b1c version:5 date:None author:Nasreddine Bencherchali, Splunk status:production type:Correlation Description:This analytic detects a correlation between privileged account creation on Cisco IOS devices and subsequent inbound SSH connections to non-standard ports or sshd_operns by correlating risk events
This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and SSH-related Snort detections ("SSH Connection to sshd_operns" or "SSH Connection to Non-Standard Port") fire for the same network device.
This behavior is highly indicative of persistence establishment following initial compromise.
Data_source:
search:| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime
sum(All_Risk.calculated_risk_score) as risk_score count(All_Risk.calculated_risk_score) as risk_event_count
values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count
values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count
values(All_Risk.tag) as tag values(source) as source dc(source) as source_count
values(contributing_events_search)
values(All_Risk.threat_object)
from datamodel=Risk.All_Risk where
source IN ( "*Cisco IOS Suspicious Privileged Account Creation*", "*Cisco Secure Firewall - SSH Connection to sshd_operns*", "*Cisco Secure Firewall - SSH Connection to Non-Standard Port*" ) by All_Risk.normalized_risk_object | `drop_dm_object_name(All_Risk)` | eval has_account_creation=if( match(source, "Cisco IOS Suspicious Privileged Account Creation"), 1, 0 ) | eval has_ssh_detection=if( match(source, "SSH Connection to sshd_operns") OR match(source, "SSH Connection to Non-Standard Port"), 1, 0 ) | where has_account_creation=1 AND has_ssh_detection=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_privileged_account_creation_with_suspicious_ssh_activity_filter`
how_to_implement:This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation", "Cisco Secure Firewall - SSH Connection to sshd_operns", and "Cisco Secure Firewall - SSH Connection to Non-Standard Port". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
known_false_positives:No false positives have been identified yet.
References: -https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a drilldown_searches: name:'View the detection results for - "$normalized_risk_object$"' search:'%original_detection_search% | search normalized_risk_object = "$normalized_risk_object$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$normalized_risk_object$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$normalized_risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Secure Firewall Threat Defense Analytics', 'Salt Typhoon']
