security_content/detections/application/ravpn___high_authentication_failures_from_source.yml at 5efd7d055675c577590ca293d54280830291d93e · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: RAVPN - High Authentication Failures from Source
id: 4a39dfc3-2ab0-4620-8da9-18e6a6bad7b6
version: 1
creation_date: '2026-04-27'
modification_date: '2026-04-27'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects a high volume of Cisco Secure Access RAVPN authentication failure events from the same client source within a five-minute window. It identifies events where AnyConnect or ASA AAA signals indicate a failed VPN authentication attempt—such as RAVPN metadata event type FAILED or ASA syslog descriptor AAA_RESULT_REJECT—and aggregates failure events per client public IP. This pattern may indicate password guessing, credential stuffing, or brute-force activity against remote access VPN. If confirmed malicious, an attacker may be attempting to obtain valid VPN credentials for initial access or persistence.
data_source:
    - Cisco Secure Access RAVPN Push Security Events
search: |-
    `cisco_secure_access_ravpn` (cisco_ravpn_metadata.event_type="FAILED" OR cisco_asa.syslog_descriptor="AAA_RESULT_REJECT")
    | eval src_ip=coalesce('cisco_ravpn_session.public_ip', src)
    | where isnotnull(src_ip) AND src_ip!=""
    | bin _time span=5m
    | stats count min(_time) as firstTime max(_time) as lastTime
        values(cisco_event_id) as cisco_event_ids
        values(cisco_asa.syslog_id) as cisco_asa_syslog_ids
        values(cloud.region) as cloud_region
      BY src_ip _time
    | where count >= 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ravpn___high_authentication_failures_from_source_filter`
how_to_implement: |
    Ingest Cisco Secure Access RAVPN push security events with sourcetype `cisco:secure_access:security_events_ravpn` using the Cisco Secure Access Add-on for Splunk (https://splunkbase.splunk.com/app/7569). This search uses the input macro `cisco_secure_access_ravpn`; replace it with your index, source, or sourcetype qualifiers as needed. A post-filter macro is included for tuning known false positives. Schedule the search every five minutes with a lookback of at least ten minutes so five-minute buckets are complete.
known_false_positives: |
    Shared NAT egress, captive portals, misconfigured AnyConnect clients, or legitimate users repeatedly entering wrong passwords can produce bursts of failures. Tune the count threshold, exclude trusted egress IPs via the filter macro, or scope to specific VPN profiles or organizations if your deployment is noisy.
references:
    - https://developer.cisco.com/docs/cloud-security/ravpn-push-security-events
    - https://attack.mitre.org/techniques/T1110/
    - https://splunkbase.splunk.com/app/7569
drilldown_searches:
    - name: View the detection results for $src_ip$
      search: '%original_detection_search% | search src_ip = $src_ip$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $src_ip$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($src_ip$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 20
          message: High volume of RAVPN authentication failures detected from source $src_ip$ within a five-minute window, which may indicate credential stuffing or brute-force activity.
threat_objects: []
analytic_story:
    - Compromised User Account
asset_type: Identity
mitre_attack_id:
    - T1110.001
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: application
security_domain: access
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/ravpn/ravpn_high_auth_failures.log
          source: not_applicable
          sourcetype: cisco:secure_access:security_events_ravpn
      test_type: unit