From 1fef712899f1b15a815b0a931984eba1e9c5f6f2 Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 13:48:06 +0200 Subject: [PATCH 01/11] Add macOS browser spawned script external network connection detection --- ...ned_script_external_network_connection.yml | 140 ++++++++++++++++++ 1 file changed, 140 insertions(+) create mode 100644 detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml new file mode 100644 index 0000000000..a4b652f2d9 --- /dev/null +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml @@ -0,0 +1,140 @@ +name: Cisco NVM - MacOS Browser Spawned Command Interpreter With External Network Connection +id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: | + Detects potentially suspicious behavior on macOS where a browser process spawns a Unix command interpreter that establishes a network connection to a public IP address. This behavior may indicate malicious browser content, a compromised website, drive-by execution, or browser-initiated command execution. +data_source: + - Cisco Network Visibility Module Flow Data +search: | + `cisco_network_visibility_module_flowdata` + | eval Image=lower(coalesce(process_path,process_exec,ppath,process)), + ParentImage=lower(coalesce(parent_process_path,parent_process_exec,pppath)), + DestinationIp=coalesce(dest,dest_ip,da,dest_n) + | where + ( + like(Image,"%/bash") OR + like(Image,"%/csh") OR + like(Image,"%/dash") OR + like(Image,"%/fish") OR + like(Image,"%/sh") OR + like(Image,"%/tcsh") OR + like(Image,"%/zsh") + ) + AND ( + like(ParentImage,"%/arc") OR + like(ParentImage,"%/brave") OR + like(ParentImage,"%/brave-browser") OR + like(ParentImage,"%/chrome") OR + like(ParentImage,"%/chromium") OR + like(ParentImage,"%/duckduckgo") OR + like(ParentImage,"%/firefox") OR + like(ParentImage,"%/firefox-bin") OR + like(ParentImage,"%/google chrome") OR + like(ParentImage,"%/google-chrome") OR + like(ParentImage,"%/librewolf") OR + like(ParentImage,"%/microsoft edge") OR + like(ParentImage,"%/msedge") OR + like(ParentImage,"%/opera") OR + like(ParentImage,"%/opera gx") OR + like(ParentImage,"%/safari") OR + like(ParentImage,"%/tor browser") OR + like(ParentImage,"%/vivaldi") OR + like(ParentImage,"%/waterfox") + ) + AND isnotnull(DestinationIp) + AND NOT ( + cidrmatch("0.0.0.0/8",DestinationIp) OR + cidrmatch("10.0.0.0/8",DestinationIp) OR + cidrmatch("100.64.0.0/10",DestinationIp) OR + cidrmatch("127.0.0.0/8",DestinationIp) OR + cidrmatch("169.254.0.0/16",DestinationIp) OR + cidrmatch("172.16.0.0/12",DestinationIp) OR + cidrmatch("192.0.0.0/24",DestinationIp) OR + cidrmatch("192.0.2.0/24",DestinationIp) OR + cidrmatch("192.168.0.0/16",DestinationIp) OR + cidrmatch("198.18.0.0/15",DestinationIp) OR + cidrmatch("198.51.100.0/24",DestinationIp) OR + cidrmatch("203.0.113.0/24",DestinationIp) OR + cidrmatch("224.0.0.0/4",DestinationIp) OR + cidrmatch("240.0.0.0/4",DestinationIp) OR + cidrmatch("255.255.255.255/32",DestinationIp) OR + cidrmatch("fc00::/7",DestinationIp) OR + cidrmatch("fe80::/10",DestinationIp) OR + cidrmatch("ff00::/8",DestinationIp) OR + cidrmatch("2001:db8::/32",DestinationIp) OR + DestinationIp="::" OR + DestinationIp="::1" + ) + | stats count + min(_time) as firstTime + max(_time) as lastTime + values(DestinationIp) as DestinationIp + values(dest_hostname) as dest_hostname + values(dest_port) as dest_port + values(transport) as transport + values(Image) as Image + values(ParentImage) as ParentImage + values(process_arguments) as process_arguments + values(parent_process_arguments) as parent_process_arguments + values(process_id) as process_id + values(parent_process_id) as parent_process_id + by host src + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table host src DestinationIp dest_hostname dest_port transport Image ParentImage process_arguments parent_process_arguments process_id parent_process_id firstTime lastTime count + | `cisco_nvm___macos_browser_spawned_script_external_network_connection_filter` +how_to_implement: | + This detection requires Cisco NVM flow telemetry ingested into Splunk using the Cisco Security Cloud application. The telemetry must include process and parent-process paths, source endpoint information, and destination IP information. Ensure the cisco_network_visibility_module_flowdata macro is configured for the appropriate NVM indexes and sourcetypes. The NVM flow events used by this analytic do not contain a reliable normalized operating-system field; therefore, the relevant NVM input, index, or deployment scope should be limited to macOS endpoints. +known_false_positives: | + Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/threats/socgholish/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src="$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Browser process $ParentImage$ spawned command interpreter $Image$ on $src$, which connected to public IP $DestinationIp$. + entity: + field: src + type: system + score: 40 +intermediate_findings: + entities: + - field: host + type: system + score: 40 + message: Browser process $ParentImage$ spawned command interpreter $Image$ on $src$, which connected to public IP $DestinationIp$. +threat_objects: + - field: Image + type: process +analytic_story: + - Cisco Network Visibility Module Analytics +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Cisco NVM Browser Spawned Interpreter Public Egress + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit \ No newline at end of file From da2a3a586547cb05044376d0610c4932e14ad343 Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 14:13:11 +0200 Subject: [PATCH 02/11] Fix browser spawned command interpreter detection naming --- ...ed_command_interpreter_with_external_network_connection.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename detections/endpoint/{cisco_nvm___macos_browser_spawned_script_external_network_connection.yml => cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml} (98%) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml similarity index 98% rename from detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml rename to detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml index a4b652f2d9..a75a56e786 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_script_external_network_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml @@ -87,7 +87,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table host src DestinationIp dest_hostname dest_port transport Image ParentImage process_arguments parent_process_arguments process_id parent_process_id firstTime lastTime count - | `cisco_nvm___macos_browser_spawned_script_external_network_connection_filter` + | `cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection_filter` how_to_implement: | This detection requires Cisco NVM flow telemetry ingested into Splunk using the Cisco Security Cloud application. The telemetry must include process and parent-process paths, source endpoint information, and destination IP information. Ensure the cisco_network_visibility_module_flowdata macro is configured for the appropriate NVM indexes and sourcetypes. The NVM flow events used by this analytic do not contain a reliable normalized operating-system field; therefore, the relevant NVM input, index, or deployment scope should be limited to macOS endpoints. known_false_positives: | From 145e4a5b137b4a46f613d0964092b9818470950f Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 14:38:45 +0200 Subject: [PATCH 03/11] Fix detection YAML formatting --- ...ned_command_interpreter_with_external_network_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml index a75a56e786..db38c8124a 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml @@ -137,4 +137,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log source: not_applicable sourcetype: cisco:nvm:flowdata:v2 - test_type: unit \ No newline at end of file + test_type: unit From f55d86fd45f7ea57da48513166ac36ff1f3cc92c Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 14:58:07 +0200 Subject: [PATCH 04/11] Fix anomaly detection finding configuration --- ...mmand_interpreter_with_external_network_connection.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml index db38c8124a..a04bdad83a 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml @@ -105,15 +105,9 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Browser process $ParentImage$ spawned command interpreter $Image$ on $src$, which connected to public IP $DestinationIp$. - entity: - field: src - type: system - score: 40 intermediate_findings: entities: - - field: host + - field: src type: system score: 40 message: Browser process $ParentImage$ spawned command interpreter $Image$ on $src$, which connected to public IP $DestinationIp$. From ab19cce89d48e4ae6f2775cd13618b7ec2f03f5f Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 15:10:35 +0200 Subject: [PATCH 05/11] Shorten macOS browser spawned shell detection name --- ...nvm___macos_browser_spawned_shell_external_connection.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml => cisco_nvm___macos_browser_spawned_shell_external_connection.yml} (97%) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml similarity index 97% rename from detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml rename to detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml index a04bdad83a..a7521d060b 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml @@ -1,4 +1,4 @@ -name: Cisco NVM - MacOS Browser Spawned Command Interpreter With External Network Connection +name: Cisco NVM - MacOS Browser Spawned Shell External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 version: 1 creation_date: '2026-09-02' @@ -87,7 +87,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table host src DestinationIp dest_hostname dest_port transport Image ParentImage process_arguments parent_process_arguments process_id parent_process_id firstTime lastTime count - | `cisco_nvm___macos_browser_spawned_command_interpreter_with_external_network_connection_filter` + | `cisco_nvm___macos_browser_spawned_shell_external_connection_filter` how_to_implement: | This detection requires Cisco NVM flow telemetry ingested into Splunk using the Cisco Security Cloud application. The telemetry must include process and parent-process paths, source endpoint information, and destination IP information. Ensure the cisco_network_visibility_module_flowdata macro is configured for the appropriate NVM indexes and sourcetypes. The NVM flow events used by this analytic do not contain a reliable normalized operating-system field; therefore, the relevant NVM input, index, or deployment scope should be limited to macOS endpoints. known_false_positives: | From 7700bd1b94918e928e0b2b18631e173b3b93f908 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 4 Sep 2026 13:21:10 +0200 Subject: [PATCH 06/11] minor fixes to search and metadata --- ...wser_spawned_shell_external_connection.yml | 106 +++++------------- 1 file changed, 28 insertions(+), 78 deletions(-) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml index a7521d060b..6796e7bdcd 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml @@ -7,89 +7,39 @@ author: Maria Jose Erquiaga, Splunk status: production type: Anomaly description: | - Detects potentially suspicious behavior on macOS where a browser process spawns a Unix command interpreter that establishes a network connection to a public IP address. This behavior may indicate malicious browser content, a compromised website, drive-by execution, or browser-initiated command execution. + Detects potentially suspicious behavior on MacOS where a browser process spawns a command interpreter that establishes a network connection to a public IP address. This behavior may indicate malicious browser content, a compromised website, drive-by execution, or browser-initiated command execution. data_source: - Cisco Network Visibility Module Flow Data search: | `cisco_network_visibility_module_flowdata` - | eval Image=lower(coalesce(process_path,process_exec,ppath,process)), - ParentImage=lower(coalesce(parent_process_path,parent_process_exec,pppath)), - DestinationIp=coalesce(dest,dest_ip,da,dest_n) - | where - ( - like(Image,"%/bash") OR - like(Image,"%/csh") OR - like(Image,"%/dash") OR - like(Image,"%/fish") OR - like(Image,"%/sh") OR - like(Image,"%/tcsh") OR - like(Image,"%/zsh") - ) - AND ( - like(ParentImage,"%/arc") OR - like(ParentImage,"%/brave") OR - like(ParentImage,"%/brave-browser") OR - like(ParentImage,"%/chrome") OR - like(ParentImage,"%/chromium") OR - like(ParentImage,"%/duckduckgo") OR - like(ParentImage,"%/firefox") OR - like(ParentImage,"%/firefox-bin") OR - like(ParentImage,"%/google chrome") OR - like(ParentImage,"%/google-chrome") OR - like(ParentImage,"%/librewolf") OR - like(ParentImage,"%/microsoft edge") OR - like(ParentImage,"%/msedge") OR - like(ParentImage,"%/opera") OR - like(ParentImage,"%/opera gx") OR - like(ParentImage,"%/safari") OR - like(ParentImage,"%/tor browser") OR - like(ParentImage,"%/vivaldi") OR - like(ParentImage,"%/waterfox") - ) - AND isnotnull(DestinationIp) - AND NOT ( - cidrmatch("0.0.0.0/8",DestinationIp) OR - cidrmatch("10.0.0.0/8",DestinationIp) OR - cidrmatch("100.64.0.0/10",DestinationIp) OR - cidrmatch("127.0.0.0/8",DestinationIp) OR - cidrmatch("169.254.0.0/16",DestinationIp) OR - cidrmatch("172.16.0.0/12",DestinationIp) OR - cidrmatch("192.0.0.0/24",DestinationIp) OR - cidrmatch("192.0.2.0/24",DestinationIp) OR - cidrmatch("192.168.0.0/16",DestinationIp) OR - cidrmatch("198.18.0.0/15",DestinationIp) OR - cidrmatch("198.51.100.0/24",DestinationIp) OR - cidrmatch("203.0.113.0/24",DestinationIp) OR - cidrmatch("224.0.0.0/4",DestinationIp) OR - cidrmatch("240.0.0.0/4",DestinationIp) OR - cidrmatch("255.255.255.255/32",DestinationIp) OR - cidrmatch("fc00::/7",DestinationIp) OR - cidrmatch("fe80::/10",DestinationIp) OR - cidrmatch("ff00::/8",DestinationIp) OR - cidrmatch("2001:db8::/32",DestinationIp) OR - DestinationIp="::" OR - DestinationIp="::1" - ) + process_path IN ("*/bash","*/csh","*/dash","*/fish","*/sh","*/tcsh","*/zsh") + parent_process_path IN ("*/arc","*/brave","*/brave-browser","*/chrome","*/chromium","*/duckduckgo","*/firefox","*/firefox-bin","*/google chrome","*/google-chrome","*/librewolf","*/microsoft edge","*/msedge","*/opera","*/opera gx","*/safari","*/tor browser","*/vivaldi","*/waterfox") + AND NOT ( + cidrmatch("0.0.0.0/8",dest_ip) OR cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("100.64.0.0/10",dest_ip) OR + cidrmatch("127.0.0.0/8",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR + cidrmatch("192.0.0.0/24",dest_ip) OR cidrmatch("192.0.2.0/24",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR + cidrmatch("198.18.0.0/15",dest_ip) OR cidrmatch("198.51.100.0/24",dest_ip) OR cidrmatch("203.0.113.0/24",dest_ip) OR + cidrmatch("224.0.0.0/4",dest_ip) OR cidrmatch("240.0.0.0/4",dest_ip) OR cidrmatch("255.255.255.255/32",dest_ip) OR + cidrmatch("fc00::/7",dest_ip) OR cidrmatch("fe80::/10",dest_ip) OR cidrmatch("ff00::/8",dest_ip) OR + cidrmatch("2001:db8::/32",dest_ip) OR dest_ip="::" OR dest_ip="::1" + ) | stats count - min(_time) as firstTime - max(_time) as lastTime - values(DestinationIp) as DestinationIp - values(dest_hostname) as dest_hostname - values(dest_port) as dest_port - values(transport) as transport - values(Image) as Image - values(ParentImage) as ParentImage - values(process_arguments) as process_arguments - values(parent_process_arguments) as parent_process_arguments - values(process_id) as process_id - values(parent_process_id) as parent_process_id - by host src + min(_time) as firstTime + max(_time) as lastTime + by src_ip dest_ip dest_hostname bytes_in bytes_out + user process_id process_name process_path process + parent_process_id parent_process_name parent_process_path parent_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table host src DestinationIp dest_hostname dest_port transport Image ParentImage process_arguments parent_process_arguments process_id parent_process_id firstTime lastTime count | `cisco_nvm___macos_browser_spawned_shell_external_connection_filter` how_to_implement: | - This detection requires Cisco NVM flow telemetry ingested into Splunk using the Cisco Security Cloud application. The telemetry must include process and parent-process paths, source endpoint information, and destination IP information. Ensure the cisco_network_visibility_module_flowdata macro is configured for the appropriate NVM indexes and sourcetypes. The NVM flow events used by this analytic do not contain a reliable normalized operating-system field; therefore, the relevant NVM input, index, or deployment scope should be limited to macOS endpoints. + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). known_false_positives: | Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. references: @@ -107,12 +57,12 @@ drilldown_searches: latest_offset: "0" intermediate_findings: entities: - - field: src - type: system + - field: src_ip + type: ip_address score: 40 - message: Browser process $ParentImage$ spawned command interpreter $Image$ on $src$, which connected to public IP $DestinationIp$. + message: Browser process $parent_process$ spawned command interpreter $process$ on $src_ip$, which connected to public IP $dest_ip$. threat_objects: - - field: Image + - field: process type: process analytic_story: - Cisco Network Visibility Module Analytics From 0519e86ad97a9faa3f354a85076bd92eb1a915ed Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 4 Sep 2026 13:24:55 +0200 Subject: [PATCH 07/11] fixing finding type --- ...co_nvm___macos_browser_spawned_shell_external_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml index 6796e7bdcd..b7774b9cdf 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml @@ -58,7 +58,7 @@ drilldown_searches: intermediate_findings: entities: - field: src_ip - type: ip_address + type: system score: 40 message: Browser process $parent_process$ spawned command interpreter $process$ on $src_ip$, which connected to public IP $dest_ip$. threat_objects: From 6647955eb9c338bc8d5b495dca4ed1d11cf44fa7 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 4 Sep 2026 13:26:31 +0200 Subject: [PATCH 08/11] added more threat objects --- ..._nvm___macos_browser_spawned_shell_external_connection.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml index b7774b9cdf..2f21a5a71a 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml @@ -64,6 +64,10 @@ intermediate_findings: threat_objects: - field: process type: process + - field: dest_ip + type: ip_address + - field: dest_hostname + type: domain analytic_story: - Cisco Network Visibility Module Analytics asset_type: Endpoint From 7f8110456f75a0ef4cd0cbedf41494015885fc1e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 5 Sep 2026 18:06:45 +0200 Subject: [PATCH 09/11] Update cisco_nvm___macos_browser_spawned_shell_external_connection.yml --- ...wser_spawned_shell_external_connection.yml | 64 +++++++++++++------ 1 file changed, 46 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml index 2f21a5a71a..beb4b146ac 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml +++ b/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml @@ -7,28 +7,56 @@ author: Maria Jose Erquiaga, Splunk status: production type: Anomaly description: | - Detects potentially suspicious behavior on MacOS where a browser process spawns a command interpreter that establishes a network connection to a public IP address. This behavior may indicate malicious browser content, a compromised website, drive-by execution, or browser-initiated command execution. + Detects a macOS browser process spawning a Unix shell that establishes an outbound connection to an external destination. + This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension. + It may also occur during legitimate automation, development, installation, or enterprise software workflows. data_source: - Cisco Network Visibility Module Flow Data search: | `cisco_network_visibility_module_flowdata` - process_path IN ("*/bash","*/csh","*/dash","*/fish","*/sh","*/tcsh","*/zsh") - parent_process_path IN ("*/arc","*/brave","*/brave-browser","*/chrome","*/chromium","*/duckduckgo","*/firefox","*/firefox-bin","*/google chrome","*/google-chrome","*/librewolf","*/microsoft edge","*/msedge","*/opera","*/opera gx","*/safari","*/tor browser","*/vivaldi","*/waterfox") - AND NOT ( - cidrmatch("0.0.0.0/8",dest_ip) OR cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("100.64.0.0/10",dest_ip) OR - cidrmatch("127.0.0.0/8",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR - cidrmatch("192.0.0.0/24",dest_ip) OR cidrmatch("192.0.2.0/24",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR - cidrmatch("198.18.0.0/15",dest_ip) OR cidrmatch("198.51.100.0/24",dest_ip) OR cidrmatch("203.0.113.0/24",dest_ip) OR - cidrmatch("224.0.0.0/4",dest_ip) OR cidrmatch("240.0.0.0/4",dest_ip) OR cidrmatch("255.255.255.255/32",dest_ip) OR - cidrmatch("fc00::/7",dest_ip) OR cidrmatch("fe80::/10",dest_ip) OR cidrmatch("ff00::/8",dest_ip) OR - cidrmatch("2001:db8::/32",dest_ip) OR dest_ip="::" OR dest_ip="::1" + process_path IN ( + "*/bash", + "*/csh", + "*/dash", + "*/fish", + "*/sh", + "*/tcsh", + "*/zsh" ) + parent_process_path IN ( + "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin", + "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera", + "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox" + ) + NOT dest IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", + "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", + "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", + "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1" + ) + | stats count min(_time) as firstTime max(_time) as lastTime - by src_ip dest_ip dest_hostname bytes_in bytes_out - user process_id process_name process_path process - parent_process_id parent_process_name parent_process_path parent_process + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(module_name_list) as module_name_list + values(module_hash_list) as module_hash_list + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + + by src src_ip dest dest_ip bytes_in bytes_out + user process_id process_name process_path process + parent_process_id parent_process_name parent_process_path parent_process + + | table + firstTime lastTime user + parent_process_path parent_process_name parent_process parent_process_hash + process_path process_name process process_hash process_id + module_name_list module_hash_list + src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___macos_browser_spawned_shell_external_connection_filter` @@ -57,10 +85,10 @@ drilldown_searches: latest_offset: "0" intermediate_findings: entities: - - field: src_ip + - field: src type: system - score: 40 - message: Browser process $parent_process$ spawned command interpreter $process$ on $src_ip$, which connected to public IP $dest_ip$. + score: 20 + message: A browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. threat_objects: - field: process type: process @@ -80,7 +108,7 @@ product: category: endpoint security_domain: endpoint tests: - - name: True Positive Test - Cisco NVM Browser Spawned Interpreter Public Egress + - name: True Positive Test - Cisco NVM attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log source: not_applicable From 7db75f4ddceaccab8092c2da579b2467ba99ad17 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 5 Sep 2026 18:21:57 +0200 Subject: [PATCH 10/11] update title --- ...owser_spawned_shell_with_external_connection.yml} | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) rename detections/endpoint/{cisco_nvm___macos_browser_spawned_shell_external_connection.yml => cisco_nvm___browser_spawned_shell_with_external_connection.yml} (88%) diff --git a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml similarity index 88% rename from detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml rename to detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml index beb4b146ac..9daacf8597 100644 --- a/detections/endpoint/cisco_nvm___macos_browser_spawned_shell_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml @@ -1,4 +1,4 @@ -name: Cisco NVM - MacOS Browser Spawned Shell External Connection +name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 version: 1 creation_date: '2026-09-02' @@ -7,9 +7,9 @@ author: Maria Jose Erquiaga, Splunk status: production type: Anomaly description: | - Detects a macOS browser process spawning a Unix shell that establishes an outbound connection to an external destination. - This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension. - It may also occur during legitimate automation, development, installation, or enterprise software workflows. + Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. + This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. + The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows. data_source: - Cisco Network Visibility Module Flow Data search: | @@ -59,7 +59,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `cisco_nvm___macos_browser_spawned_shell_external_connection_filter` + | `cisco_nvm___browser_spawned_shell_with_external_connection_filter` how_to_implement: | This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. @@ -88,7 +88,7 @@ intermediate_findings: - field: src type: system score: 20 - message: A browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. + message: A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. threat_objects: - field: process type: process From bfd0b9231c15fabb5fede133bb618465508fbb3c Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sat, 5 Sep 2026 18:23:55 +0200 Subject: [PATCH 11/11] fix filename --- ...m___browser_spawned_unix_shell_with_external_connection.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename detections/endpoint/{cisco_nvm___browser_spawned_shell_with_external_connection.yml => cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml} (98%) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml similarity index 98% rename from detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml rename to detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 9daacf8597..768ff926ec 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -59,7 +59,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `cisco_nvm___browser_spawned_shell_with_external_connection_filter` + | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` how_to_implement: | This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`.