Detect Remote Access Software Usage Traffic

name: Detect Remote Access Software Usage Traffic
id: 885ea672-07ee-475a-879e-60d28aa5dd42
version: 18
creation_date: '2024-03-06'
modification_date: '2026-10-08'
author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
    It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
data_source:
    - Palo Alto Network Traffic
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(All_Traffic.dest_port) as dest_port
            latest(All_Traffic.user) as user

    FROM datamodel=Network_Traffic WHERE

    [
        | inputlookup remote_access_software
        | search match_pattern!=""
        | rename match_pattern as All_Traffic.app
        | table All_Traffic.app
    ]

    BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
       All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip
       All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
       All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
       All_Traffic.src_port All_Traffic.transport All_Traffic.user
       All_Traffic.vendor_product

    | `drop_dm_object_name("All_Traffic")`

    | lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_access_software_usage_exceptions`
    | `detect_remote_access_software_usage_traffic_filter`
how_to_implement: |-
    The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic
    data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro
    leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain
    device- based exceptions for this set of detections.
known_false_positives: |-
    It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional
    remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup
    to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
    - https://applipedia.paloaltonetworks.com/
drilldown_searches:
    - name: View the detection results for - "$src$"
      search: '%original_detection_search% | search  src = "$src$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$src$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
    - name: Investigate application traffic for $app$
      search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$].
        - field: user
          type: user
          score: 20
          message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$].
threat_objects:
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Remote Monitoring and Management Software
    - Scattered Spider
    - Interlock Ransomware
    - Scattered Lapsus$ Hunters
asset_type: Network
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo_traffic.log
          source: not_applicable
          sourcetype: pan:traffic
      description: PORTED MANUAL TEST - This detection uses A&I lookups from Enterprise Security.
      test_type: experimental