Name:Cisco SA - Automated Web Reconnaissance via HTTP Access Errors id:4cd44520-d404-4ca8-b736-c9d6b86ecf31 version:2 date:None author:Mahamudul Chowdhury, Bhavin Patel, Splunk status:production type:Anomaly Description:This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
Data_source:
-Cisco Secure Access Proxy
search:`cisco_secure_access_proxy` | eval src_ip=coalesce(src_ip, src) | eval host=coalesce(hostname, host) | eval user=coalesce(user, identities) | eval status=tonumber(status) | eval domain=replace(url, "^https?://([^/]+).*$", "\\1") | eval user_agent=coalesce(http_user_agent, user_agent) | where status IN (400, 401, 403, 404, 405, 407, 414, 429, 431) | bucket _time span=10m | stats count as errors dc(url) as unique_urls values(status) as statuses values(user_agent) as user_agent values(host) as host values(user) as user by src_ip domain _time | where errors > 100 AND unique_urls > 50 | eval firstTime=_time, lastTime=_time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_sa___automated_web_reconnaissance_via_http_access_errors_filter`
how_to_implement:Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.
known_false_positives:Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.
References: -https://attack.mitre.org/techniques/T1595/ drilldown_searches: name:'View the detection results for - "$src_ip$"' search:'%original_detection_search% | search src_ip = "$src_ip$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$src_ip$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Secure Access Analytics']
