Cisco NVM Analytics & Updates - First Batch

[nasbench]

New Analytics

• Cisco NVM - Curl Execution With Insecure Flags
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Non-Network Binary Making Network Connection
• Cisco NVM - Outbound Connection to Suspicious Port
• Cisco NVM - Rclone Execution With Network Activity
• Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Cisco NVM - Suspicious Download From File Sharing Website
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Cisco NVM - Webserver Download From File Sharing Website
• Cisco NVM - Installation of Typosquatted Python Package
• Cisco NVM - Suspicious Download From File Sharing Website
• Cisco NVM - Suspicious File Download via Headless Browser
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Cisco NVM - Suspicious Network Connection Initiated via MsXsl
• Cisco NVM - Suspicious Network Connection to IP Lookup Service API
• Windows File Download Via PowerShell

NVM Mapped Analytics

• Attacker Tools On Endpoint
• Detect HTML Help URL in Command Line
• Detect MSHTA Url in Command Line
• Detect RClone Command-Line Usage
• Windows Curl Download to Suspicious Path
• Windows Curl Upload to Remote Destination
• Windows File Download Via CertUtil
• Windows HTTP Network Communication From MSIExec
• Windows InstallUtil Remote Network Connection
• Windows InstallUtil URL in Command Line
• Windows MSIExec Remote Download
• Windows PowerShell FakeCAPTCHA Clipboard Execution
• WMIC XSL Execution via URL
• Windows File Download Via PowerShell

Updated Analytics - Logic

• Windows Curl Download to Suspicious Path - Increased coverage by adding new paths

New Data Sources

• Cisco Network Visibility Module Flow Data
• Cisco Network Visibility Module OSquery

New Analytic Stories

• Cisco Network Visibility Module Analytics

New Macros

• cisco_network_visibility_module_flowdata

New Lookups

• suspicious_ports_list.csv
• typo_squatted_python_packages.csv

Updated Lookups

• attacker_tools - Removed duplicate entries

Deprecated Analytics

• Any Powershell DownloadFile
• Any Powershell DownloadString
• Windows InstallUtil Uninstall Option with Network

[patel-bhavin]

The latest updates look good! Manually tested the searches on Hoth and discussed with the author regarding some changes.