Splunk unknown stable spl

Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity

This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 61514 (Veeam Backup and Replication credential dump attempt) is followed within a 5-minute window by 64795 (Veeam Backup and Replication xp_cmdshell invocation attempt), which detects the use of `xp_cmdshell`, a common post-exploitation technique. If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.

View Source

Detection Logic

`cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (61514, 64795)
| bin _time span=5m
| fillnull
| stats dc(signature_id) as unique_signature_count
        values(signature_id) as signature_id
        values(signature) as signature
        values(class_desc) as class_desc
        values(MitreAttackGroups) as MitreAttackGroups
        values(InlineResult) as InlineResult
        values(InlineResultReason) as InlineResultReason
        values(src) as src
        values(dest_port) as dest_port
        values(rule) as rule
        values(transport) as transport
        values(app) as app
        min(_time) as firstTime
        max(_time) as lastTime
        by dest
| where unique_signature_count = 2
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity_filter`

False Positives

⚠ False positives should be very unlikely.

Field Validations

Loading…

Comments (0)

Loading comments...